chore(renovate): Update library/postgres Docker tag to v17

## [1.3.2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.3.1...v1.3.2) (2025-05-06)

### Bug Fixes

* **dovecot:** Update Helm chart to fix migration mode ([7ba84b9](7ba84b99ca))
* **helmfile:** Explicitly template auth-modules in OX App Suite; Streamline name of OX App Suite EE image ([6cbb6b6](6cbb6b6922))

.gitignore

@@ -8,6 +8,9 @@
 helmfile/environments/dev/*.yaml.gotmpl
 helmfile/environments/test/*.yaml.gotmpl
 helmfile/environments/prod/*.yaml.gotmpl
+helmfile/environments/dev/*/
+helmfile/environments/test/*/
+helmfile/environments/prod/*/
 !helmfile/environments/dev/sample.yaml.gotmpl
 !helmfile/environments/test/sample.yaml.gotmpl
 !helmfile/environments/prod/sample.yaml.gotmpl

.gitlab-ci.yml

@@ -4,11 +4,17 @@
 ---
 include:
   - project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
-    ref: "v2.4.8"
+    ref: "v2.4.9"
     file:
       - "ci/common/lint.yml"
       - "ci/release-automation/semantic-release.yml"
   - local: "/.gitlab/generate/generate-docs.yml"
+  - local: "/.gitlab/renovate/renovate.yml"
+  - local: "/.gitlab/release/release-common.yml"
+  - local: "/.gitlab/release/release-generate-version.yml"
+  - local: "/.gitlab/release/release-semantic.yml"
+  - local: "/.gitlab/lint/lint-common.yml"
+  - local: "/.gitlab/lint/lint-reuse.yml"
   - project: "${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}"
     file: "gitlab/environments.yaml"
     ref: "main"
@@ -51,9 +57,10 @@ variables:
     description: "The name of namespaces to deploy to."
     value: ""
   CLUSTER:
-    description: "Which cluster to use. Cluster must be defined in `gitlab/environments.yaml` of the
-        repo that is included above using the env var `PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG`:
-        ${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}"
+    description: >
+      Which cluster to use. Cluster must be defined in `gitlab/environments.yaml` of the
+      repo that is included above using the env var `PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG`:
+      ${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}
     value: "dev"
   MASTER_PASSWORD_WEB_VAR:
     description: >
@@ -66,13 +73,29 @@ variables:
     options:
       - "yes"
       - "no"
-  DEBUG_ENABLED:
-    description: "Allows to set `debug.enabled` to true for a deployment, needs to be supported by stage specific\
-     configuration containing: `debug.enabled: {{ env \"DEBUG_ENABLED\" | default false }}`"
+  FLUSH_EXTERNAL_SERVICES_BEFORE:
+    description: >
+      Recreates databases and purges objectstorage. Useful when using external services and required overrides.
     value: "no"
     options:
       - "yes"
       - "no"
+  DEBUG_ENABLED:
+    description: >
+      Allows to set `debug.enabled` to true for a deployment, needs to be supported by stage specific
+      configuration containing: `debug.enabled: {{ env "DEBUG_ENABLED" | default false }}`
+    value: "no"
+    options:
+      - "yes"
+      - "no"
+  OPENDESK_ENTERPRISE:
+    description: >
+      Set to `true` if you want to deploy openDesk EE (but be sure you provide the required EE keys/tokens
+      for the application)
+    value: "false"
+    options:
+      - "true"
+      - "false"
   DEPLOY_ALL_COMPONENTS:
     description: "Enable all component deployment (overwrites 'no' setting on component level)."
     value: "no"
@@ -145,15 +168,16 @@ variables:
     options:
       - "yes"
       - "no"
-  CREATE_DEFAULT_ACCOUNTS:
-    description: "Creates `default` and `default-admin` in the instance using the password defined as CI variable
-                 `DEFAULT_ACCOUNTS_PASSWORD`."
+  DEPLOY_NOTES:
+    description: "Enable Notes deployment."
     value: "no"
     options:
       - "yes"
       - "no"
-  DEPLOY_NOTES:
-    description: "Enable Notes deployment."
+  CREATE_DEFAULT_ACCOUNTS:
+    description: >
+      Creates `default` and `default-admin` in the instance using the password defined as CI variable
+      `DEFAULT_ACCOUNTS_PASSWORD`.
     value: "no"
     options:
       - "yes"
@@ -173,22 +197,29 @@ variables:
   TESTS_BRANCH:
     description: "Branch of E2E-tests on which the test pipeline is triggered"
     value: "develop"
-  TESTS_PROJECT_URL:
-    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
-    value: "gitlab.opencode.de/api/v4/projects/1506"
   TESTS_TESTSET:
-    description: "Selects test set for E2E-tests"
+    description: >
+      Selects test set for E2E-tests (Regression, Smoke or Nightly), name multiple comma separated to trigger the
+      sets in one launch, use semikolon to trigger the sets in different launches.
     value: "Smoke"
+  TESTS_BROWSER:
+    description: "Select the browser (engine) to use for the test run."
+    value: "chromium"
     options:
-      - "Regression"
-      - "Smoke"
+      - "chromium"
+      - "webkit"
+      - "firefox"
   TESTS_GRACE_PERIOD:
-    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail.
-                  GRACE_PERIOD is the period in seconds that should be waited before running the tests."
+    description: >
+      A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail. Here you
+      can set the time in seconds that should be waited before running the tests.
     value: "0"
   TESTS_NUMBER_OF_THREADS:
     description: "How many threads are used for executing the tests in parallel?"
     value: "8"
+  TESTS_PROJECT_URL:
+    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
+    value: "gitlab.opencode.de/api/v4/projects/1506"
 
 # Declare .environments which is in `opendesk-env` repository. In case it is not available
 # 'cache' is used because job as a dummy key, as the job is not allowed to be empty.
@@ -201,8 +232,8 @@ variables:
   extends: ".environments"
   environment:
     name: "${NAMESPACE}"
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.1.0\
-          @sha256:74f349066ac5d20e3afaa6abd28781b4c8dc086f67e3d3c1b8345e4a9c3371b1"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.3.1\
+          @sha256:de527f493044f06009045c369be831ababbc8dd74adaa378613c5acb1e654959"
   script:
     - "cd ${CI_PROJECT_DIR}/helmfile/apps/${COMPONENT}"
     # MASTER_PASSWORD_WEB_VAR as precedence for MASTER_PASSWORD
@@ -220,9 +251,137 @@ variables:
   variables:
     HELMFILE_ENVIRONMENT: "dev"
 
+db-cleanup:
+  extends: ".deploy-common"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-ci-toolbox:1.0.0\
+          @sha256:8c00f96cbfca32e4a724c552143c7172980dd03c573fb097e57a2351db6421ab"
+  needs:
+    - job: "env-cleanup"
+      optional: true
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
+          $NAMESPACE =~ /.+/ &&
+          $ENV_STOP_BEFORE != "no" &&
+          $FLUSH_EXTERNAL_SERVICES_BEFORE != "no"
+      when: "on_success"
+  script:
+    # yamllint disable-line rule:line-length rule:quoted-strings
+    - export FILES=(${CI_PROJECT_DIR}/helmfile/environments/default/database.yaml.gotmpl ${CI_PROJECT_DIR}/helmfile/environments/dev/write-over-values-for-environment.yaml.gotmpl)
+    # Cleanup MariaDB
+    - |
+      export DATABASES="oxAppSuite"
+      export MARIADB_HOST=""
+      export MARIADB_PORT=""
+      export MARIADB_USERNAME=""
+      export MARIADB_PASSWORD=""
+
+      for DATABASE in $DATABASES; do
+        export ENV_DATABASE=${DATABASE}
+
+        # Parse cluster values
+        for FILE in ${FILES[@]}; do
+          if [ -f ${FILE} ]; then
+            if [[ $(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)]') != "null" ]]; then
+              MARIADB_DATABASE=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].name')
+              MARIADB_USERNAME=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].username')
+              MARIADB_PASSWORD=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].password')
+              MARIADB_HOST=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].host')
+              MARIADB_PORT=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].port')
+            fi;
+          fi;
+        done;
+
+        CONNECTION="--host=${MARIADB_HOST} \
+                    --port=${MARIADB_PORT} \
+                    --user=${MARIADB_USERNAME} \
+                    --password=${MARIADB_PASSWORD} \
+                    --skip-ssl"
+
+        echo "[mysql] [${ENV_DATABASE}] DROP ${MARIADB_DATABASE} on ${MARIADB_HOST}"
+        mariadb ${CONNECTION} -e "DROP DATABASE IF EXISTS ${MARIADB_DATABASE};"
+
+        if [ "${ENV_DATABASE}" = "oxAppSuite" ]; then
+          echo "[mysql] [${ENV_DATABASE}] DROP oxguard on ${MARIADB_HOST}"
+          mariadb ${CONNECTION} -e "DROP DATABASE IF EXISTS oxguard;"
+          echo "[mysql] [${ENV_DATABASE}] DROP oxguard_1 on ${MARIADB_HOST}"
+          mariadb ${CONNECTION} -e "DROP DATABASE IF EXISTS oxguard_1;"
+          echo "[mysql] [${ENV_DATABASE}] DROP PRIMARYDB_9 on ${MARIADB_HOST}"
+          mariadb ${CONNECTION} -e "DROP DATABASE IF EXISTS PRIMARYDB_9;"
+        else
+          mariadb ${CONNECTION} -e "CREATE DATABASE ${MARIADB_DATABASE};"
+          mariadb ${CONNECTION} -e "GRANT ALL PRIVILEGES ON ${MARIADB_DATABASE}.* TO ${MARIADB_USERNAME}@\"%\";"
+          mariadb ${CONNECTION} -e "FLUSH PRIVILEGES;"
+        fi;
+      done;
+    # Cleanup PostgreSQL
+    - |
+      export DATABASES="keycloak keycloakExtension nextcloud notes openproject synapse umsGuardianManagementApi \
+      umsNotificationsApi umsSelfservice xwiki"
+      export PGDATABASE="postgres"
+      export PGHOST=""
+      export PGPORT=""
+      export PGUSER=""
+      export PGPASSWORD=""
+      export PGPARAMS=""
+
+      for DATABASE in $DATABASES; do
+        export ENV_DATABASE=${DATABASE}
+
+        # Parse cluster values
+        for FILE in ${FILES[@]}; do
+          if [ -f $FILE ]; then
+            if [[ $(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)]') != "null" ]]; then
+              POSTGRES_DATABASE=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].name')
+              PGUSER=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].username')
+              PGPASSWORD=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].password')
+              PGHOST=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].host')
+              PGPORT=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].port')
+              PGPARAMS=$(tail -n +5 $FILE | yq '.databases.[env(ENV_DATABASE)].parameters')
+            fi;
+          fi;
+        done;
+
+        echo "[psql] [${ENV_DATABASE}] DROP ${POSTGRES_DATABASE} on ${PGHOST}"
+        psql -c "DROP DATABASE ${POSTGRES_DATABASE}" || true;
+        if [ "${PGPARAMS}" = "null" ]; then
+        psql -c "CREATE DATABASE \"${POSTGRES_DATABASE}\";"
+        else
+        psql -c "CREATE DATABASE \"${POSTGRES_DATABASE}\" ${PGPARAMS};"
+        fi;
+        psql -c "ALTER DATABASE \"${POSTGRES_DATABASE}\" OWNER TO \"${PGUSER}\"";
+        psql -c "GRANT ALL PRIVILEGES ON DATABASE \"${POSTGRES_DATABASE}\" TO \"${PGUSER}\"";
+      done;
+    # Cleanup Objectstore
+    - |
+      export BUCKETS="migrations nextcloud openproject nubus notes"
+      export AWS_DEFAULT_REGION=""
+      export AWS_ENDPOINT=""
+      export AWS_ACCESS_KEY_ID=""
+      export AWS_SECRET_ACCESS_KEY=""
+
+      for BUCKET in $BUCKETS; do
+        export ENV_BUCKET=${BUCKET}
+
+        # Parse cluster values
+        for FILE in ${FILES[@]}; do
+          if [ -f $FILE ]; then
+            if [[ $(tail -n +5 $FILE | yq '.objectstores.[env(ENV_BUCKET)]') != "null" ]]; then
+              AWS_BUCKET=$(tail -n +5 $FILE | yq '.objectstores.[env(ENV_BUCKET)].bucket')
+              AWS_ENDPOINT=$(tail -n +5 $FILE | yq '.objectstores.[env(ENV_BUCKET)].endpoint')
+              AWS_ACCESS_KEY_ID=$(tail -n +5 $FILE | yq '.objectstores.[env(ENV_BUCKET)].username')
+              AWS_SECRET_ACCESS_KEY=$(tail -n +5 $FILE | yq '.objectstores.[env(ENV_BUCKET)].secretKey')
+              AWS_DEFAULT_REGION=$(tail -n +5 $FILE | yq '.objectstores.[env(ENV_BUCKET)].region')
+            fi;
+          fi;
+        done;
+
+        aws s3 --endpoint "https://${AWS_ENDPOINT}" rm s3://${AWS_BUCKET} --recursive
+      done;
+  stage: "env-cleanup"
+
 env-cleanup:
   extends: ".deploy-common"
-  needs: []
   rules:
     - if: >
           $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
@@ -286,13 +445,13 @@ env-start:
   after_script:
     # Set credentials for openDesk Enterprise Registry
     - |
-      if [[ -n "${OPENDESK_ENTERPRISE}" ]]; then
-        kubectl create secret
-        --namespace "${NAMESPACE}"
-        docker-registry enterprise-registry
-        --docker-server "registry.opencode.de"
-        --docker-username "${OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME}"
-        --docker-password "${OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD}"
+      if [ "${OPENDESK_ENTERPRISE}" = "true" ]; then
+        kubectl create secret \
+        --namespace "${NAMESPACE}" \
+        docker-registry enterprise-registry \
+        --docker-server "registry.opencode.de" \
+        --docker-username "${OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME}" \
+        --docker-password "${OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD}" \
         --dry-run=client -o yaml | kubectl apply -f -
       fi
   stage: "env"
@@ -536,7 +695,8 @@ import-default-accounts:
         --admin_enable_fileshare True \
         --admin_enable_knowledgemanagement True \
         --admin_enable_projectmanagement True \
-        --create_admin_accounts True
+        --create_admin_accounts True \
+        --verify_certificate False
 
 run-tests:
   stage: "post-execute"
@@ -555,6 +715,10 @@ run-tests:
           - "de"
           - "en"
   script:
+    - |
+      if [ "${LANGUAGE}" = "en" ]; then
+        sleep 30
+      fi
     - |
       curl --request POST \
       --header "Content-Type: application/json" \
@@ -567,6 +731,7 @@ run-tests:
           \"namespace\": \"${NAMESPACE}\", \
           \"url\": \"https://portal.${DOMAIN}/\", \
           \"language\": \"${LANGUAGE}\", \
+          \"browser\": \"${TESTS_BROWSER}\", \
           \"udm_api_username\": \"Administrator\", \
           \"udm_api_password\": \"${DEFAULT_ADMINISTRATOR_PASSWORD}\", \
           \"screenshot_test\": \"yes\", \
@@ -575,6 +740,7 @@ run-tests:
           \"screenshot_redirect_step\": \"yes\", \
           \"testset\": \"${TESTS_TESTSET}\", \
           \"testprofile\": \"Namespace\", \
+          \"OPENDESK_ENTERPRISE\": \"${OPENDESK_ENTERPRISE}\", \
           \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\", \
           \"NUMBER_OF_THREADS\": \"${TESTS_NUMBER_OF_THREADS}\" \
         } \
@@ -603,6 +769,17 @@ avscan-prepare:
         stage: "scan"
         image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/clamav-imagescan:1.0.0"
         before_script:
+          - "mkdir -p ~/.docker"
+          - |
+            cat << EOF > ~/.docker/config.json
+            {
+              "auths": {
+                "$CI_REGISTRY": {
+                  "auth": "$(printf %s:%s ${CI_REGISTRY_USER} ${CI_REGISTRY_PASSWORD} | base64 | tr -d '\n')"
+                }
+              }
+            }
+            EOF
           - "sed -i \"/^DatabaseMirror .*$/c DatabaseMirror ${DATABASE_MIRROR}\" /etc/clamav/freshclam.conf"
           - "freshclam"
           - "mkdir /scan"
@@ -646,110 +823,4 @@ avscan-start:
       - artifact: "dynamic-scans.yml"
         job: "avscan-prepare"
     strategy: "depend"
-
-# Overwrite shared settings
-.common-semantic-release:
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release:1.1.0"
-  tags: []
-
-conventional-commits-linter:
-  rules:
-    - if: >
-          $RUN_RENOVATE == "yes" ||
-          $JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' ||
-          $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'
-      when: "never"
-    - when: "always"
-
-common-yaml-linter:
-  rules:
-    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
-      when: "never"
-    - when: "always"
-
-reuse-linter:
-  allow_failure: false
-  rules:
-    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
-      when: "never"
-    - when: "always"
-
-generate-release-version:
-  rules:
-    - if: >
-        $JOB_RELEASE_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
-        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
-      when: "on_success"
-
-release:
-  rules:
-    - if: >
-        $JOB_AVSCAN_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
-        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
-      when: "on_success"
-  script:
-    - >
-      export RELEASE_VERSION=$(semantic-release --dry-run --branches $CI_COMMIT_REF_NAME --plugins
-      "@semantic-release/gitlab" | grep -oP "Published release [0-9]+\.[0-9]+\.[0-9]+ on" |
-      grep -oP "[0-9]+\.[0-9]+\.[0-9]+")
-    - |
-      if [ -z "${RELEASE_VERSION}" ]; then
-        echo "RELEASE_VERSION=$(git describe --tags --abbrev=0 | sed s@^v@@g )"
-      else
-        echo "RELEASE_VERSION=${RELEASE_VERSION}"
-      fi
-    - |
-      echo -e "\n[INFO] Writing data to helm value file..."
-      cat <<EOF >helmfile/environments/default/global.generated.yaml.gotmpl
-      # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-      # SPDX-License-Identifier: Apache-2.0
-      ---
-      global:
-        systemInformation:
-          releaseVersion: "v$(echo -E "$RELEASE_VERSION")"
-      ...
-      EOF
-    - |
-      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
-      {
-        "branches": ["main"],
-        "plugins": [
-          "@semantic-release/gitlab",
-          "@semantic-release/release-notes-generator",
-          "@semantic-release/changelog",
-          ["@semantic-release/git", {
-            "assets": [
-              "charts/**/Chart.yaml",
-              "CHANGELOG.md",
-              "charts/**/README.md",
-              "helmfile/environments/default/global.generated.yaml.gotmpl",
-              ".kyverno/kyverno-test.yaml",
-              "docs"
-            ],
-            "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
-          }]
-        ]
-      }
-      EOF
-    - "semantic-release"
-  needs:
-    - "generate-docs"
-
-renovate:
-  rules:
-    - if: >
-        $RUN_RENOVATE == "yes"
-      when: "on_success"
-  # The `-full` image does not install the dependencies on the fly, that is our preferred approach
-  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/renovate/renovate:37.356-full"
-  variables:
-    RENOVATE_CONFIG_FILE: "${CI_PROJECT_DIR}/.renovate/config.yaml"
-    RENOVATE_ENDPOINT: "${CI_API_V4_URL}"
-    # Increase the renovatebot log level on stdout
-    LOG_LEVEL: "DEBUG"
-  script:
-    - "renovate ${RENOVATE_EXTRA_FLAGS}"
-  stage: "renovate"
 ...

.gitlab/common/common.yml

@@ -2,8 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.7.1\
-    @sha256:f09e36a4ad4b3a3a9ed260d6f36293002e39866a877c0a6b1efa16a88b8fd107"
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.7.2\
+    @sha256:e33a6327b9c8f89f6e86d13804d5d81e9fdf6974a2f280874d6901067c22fd83"
   OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.14\
     @sha256:34d2a96e5fc25155abd48fef4d335b131c71d8cbc00ad531df0cae9918b9f2ab"
 

.gitlab/lint/lint-common.yml

@@ -1,3 +1,4 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
@@ -8,4 +9,18 @@ include:
   extends: ".common"
   stage: "lint"
 
+common-yaml-linter:
+  rules:
+    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
+      when: "never"
+    - when: "always"
+
+conventional-commits-linter:
+  rules:
+    - if: >
+          $RUN_RENOVATE == "yes" ||
+          $JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' ||
+          $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'
+      when: "never"
+    - when: "always"
 ...

.gitlab/lint/lint-kyverno.yml

@@ -5,7 +5,7 @@ include:
   - local: "/.gitlab/lint/lint-common.yml"
 
 lint-kyverno:
-  allow_failure: true
+  allow_failure: false
   extends: ".lint-common"
   image: "${OPENDESK_LINT_IMAGE}"
   parallel:

.gitlab/lint/lint-reuse.yml

@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+reuse-linter:
+  allow_failure: false
+  rules:
+    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
+      when: "never"
+    - when: "always"
+...

.gitlab/release/release-common.yml

@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+# Overwrite shared settings
+.common-semantic-release:
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release:1.1.0"
+  tags: []
+...

.gitlab/release/release-generate-version.yml

@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+generate-release-version:
+  rules:
+    - if: >
+        $JOB_RELEASE_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
+      when: "on_success"
+...

.gitlab/release/release-semantic.yml

@@ -0,0 +1,63 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+release:
+  cache:
+    - key: "generate-docs-${CI_COMMIT_REF_SLUG}"
+      paths:
+        - "${CI_PROJECT_DIR}/docs"
+      policy: "pull"
+  rules:
+    - if: >
+        $JOB_AVSCAN_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
+      when: "on_success"
+  script:
+    - >
+      export RELEASE_VERSION=$(semantic-release --dry-run --branches $CI_COMMIT_REF_NAME --plugins
+      "@semantic-release/gitlab" | grep -oP "Published release [0-9]+\.[0-9]+\.[0-9]+ on" |
+      grep -oP "[0-9]+\.[0-9]+\.[0-9]+")
+    - |
+      if [ -z "${RELEASE_VERSION}" ]; then
+        echo "RELEASE_VERSION=$(git describe --tags --abbrev=0 | sed s@^v@@g )"
+      else
+        echo "RELEASE_VERSION=${RELEASE_VERSION}"
+      fi
+    - |
+      echo -e "\n[INFO] Writing data to helm value file..."
+      cat <<EOF >helmfile/environments/default/global.generated.yaml.gotmpl
+      # SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+      # SPDX-License-Identifier: Apache-2.0
+      ---
+      global:
+        systemInformation:
+          releaseVersion: "v$(echo -E "$RELEASE_VERSION")"
+      ...
+      EOF
+    - |
+      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
+      {
+        "branches": ["main"],
+        "plugins": [
+          "@semantic-release/gitlab",
+          "@semantic-release/release-notes-generator",
+          "@semantic-release/changelog",
+          ["@semantic-release/git", {
+            "assets": [
+              "charts/**/Chart.yaml",
+              "CHANGELOG.md",
+              "charts/**/README.md",
+              "helmfile/environments/default/global.generated.yaml.gotmpl",
+              ".kyverno/kyverno-test.yaml",
+              "docs"
+            ],
+            "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+          }]
+        ]
+      }
+      EOF
+    - "semantic-release"
+  needs:
+    - "generate-docs"
+...

.gitlab/renovate/renovate.yml

@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+renovate:
+  rules:
+    - if: >
+        $RUN_RENOVATE == "yes"
+      when: "on_success"
+  # The `-full` image does not install the dependencies on the fly, that is our preferred approach
+  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/renovate/renovate:37.356-full"
+  variables:
+    RENOVATE_CONFIG_FILE: "${CI_PROJECT_DIR}/.renovate/config.yaml"
+    RENOVATE_ENDPOINT: "${CI_API_V4_URL}"
+    # Increase the renovatebot log level on stdout
+    LOG_LEVEL: "DEBUG"
+  script:
+    - "renovate ${RENOVATE_EXTRA_FLAGS}"
+  stage: "renovate"
+...

.opencode/openDesk-logo-rgb-color.svg

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 693.25 214.02">
+  <defs>
+    <style>
+      .cls-1 {
+        fill: #571efa;
+      }
+
+      .cls-2 {
+        fill: #927afa;
+      }
+    </style>
+  </defs>
+  <g>
+    <path class="cls-2" d="M126.14,140.32v2.13c0,8.99-7.31,16.3-16.3,16.3h-38.26c-8.99,0-16.3-7.31-16.3-16.3v-38.26c0-8.99,7.31-16.3,16.3-16.3h2.13v52.44h52.44Z"/>
+    <path class="cls-1" d="M126.85,127.56h-40.39v-44.65c0-15.24,12.4-27.64,27.64-27.64h12.76c17.58,0,31.89,14.31,31.89,31.89v8.5c0,17.58-14.31,31.89-31.89,31.89ZM104.88,109.13h21.97c7.42,0,13.46-6.04,13.46-13.46v-8.5c0-7.42-6.04-13.46-13.46-13.46h-12.76c-5.08,0-9.21,4.13-9.21,9.21v26.22Z"/>
+  </g>
+  <g>
+    <path d="M210.82,90.76c14.85,0,24.34,10.9,24.34,24.25s-9.49,24.25-24.34,24.25-24.44-10.9-24.44-24.25,9.49-24.25,24.44-24.25ZM210.82,133.34c11.37,0,17.39-8.46,17.39-18.33s-6.02-18.33-17.39-18.33-17.48,8.46-17.48,18.33,6.01,18.33,17.48,18.33Z"/>
+    <path d="M244.19,91.7h6.96v11.84c3.29-7.8,10.25-12.78,20.4-12.78,13.07,0,21.9,9.87,21.9,24.34s-8.83,24.16-21.9,24.16c-10.34,0-17.2-5.17-20.4-12.78v28.95h-6.96v-63.73ZM269.38,133.34c9.4,0,17.11-5.83,17.11-18.24s-7.71-18.42-17.11-18.42-17.95,6.11-17.95,18.42,8.65,18.24,17.95,18.24Z"/>
+    <path d="M322.96,90.76c13.35,0,22.28,8.37,22.28,22.65v2.82h-37.5c.28,9.78,5.26,17.29,15.6,17.29,8.55,0,13.54-4.51,15.23-11.47h6.86c-1.97,8.27-7.61,17.2-21.9,17.2-15.13,0-22.46-11.28-22.46-24.91,0-15.04,8.74-23.59,21.9-23.59ZM338.37,110.78c-.66-9.12-6.77-14.29-15.51-14.29-8.18,0-14.29,5.26-15.04,14.29h30.55Z"/>
+    <path d="M355.01,91.7h6.96v12.97c2.54-8.65,9.12-13.91,19.36-13.91s16.73,6.77,16.73,18.99v28.57h-7.05v-28.01c0-9.68-3.76-13.63-12.03-13.63-10.53,0-17.01,8.84-17.01,21.34v20.3h-6.96v-46.62Z"/>
+    <path d="M409.81,72.05h24.35c6.89,0,12.97.85,18.24,2.54,5.26,1.69,9.57,4.98,12.92,9.87,3.35,4.89,5.03,11.78,5.03,20.68s-1.68,15.89-5.03,20.77c-3.35,4.89-7.66,8.18-12.92,9.87-5.27,1.69-11.34,2.54-18.24,2.54h-24.35v-66.27ZM434.16,125.07c4.76,0,8.57-.38,11.42-1.13s5.17-2.55,6.96-5.41c1.79-2.85,2.68-7.32,2.68-13.39s-.91-10.46-2.72-13.35c-1.82-2.88-4.14-4.7-6.96-5.45s-6.61-1.13-11.37-1.13h-9.31v39.86h9.31Z"/>
+    <path d="M480.17,101.33c2.1-3.67,5.01-6.47,8.74-8.41s8.01-2.91,12.83-2.91c7.9,0,14.07,2.1,18.52,6.3,4.45,4.2,6.67,10,6.67,17.39v3.95h-35.53c.25,3.38,1.32,6.03,3.2,7.94,1.88,1.91,4.45,2.87,7.71,2.87,2.82,0,5.15-.59,7-1.79,1.85-1.19,3.02-2.88,3.53-5.08h14.19c-.75,5.26-3.28,9.53-7.57,12.78-4.29,3.26-9.98,4.89-17.06,4.89-5.2,0-9.71-1.05-13.54-3.15-3.82-2.1-6.75-5.03-8.79-8.79-2.04-3.76-3.05-8.08-3.05-12.97s1.05-9.35,3.15-13.02ZM513.02,109.93c-.25-3.01-1.36-5.33-3.34-6.96-1.97-1.63-4.53-2.44-7.66-2.44s-5.56.82-7.47,2.44c-1.91,1.63-2.99,3.95-3.24,6.96h21.71Z"/>
+    <path d="M539.62,134.65c-4.14-3.07-6.21-7.58-6.21-13.54h14.29c0,2.7.85,4.69,2.54,5.97,1.69,1.29,4.29,1.93,7.8,1.93,2.57,0,4.43-.33,5.59-.99,1.16-.66,1.74-1.71,1.74-3.15,0-1-.34-1.82-1.03-2.44-.69-.63-1.79-1.16-3.29-1.6l-14.48-3.95c-3.2-.81-5.95-2.27-8.27-4.37-2.32-2.1-3.48-5-3.48-8.7,0-4.45,1.83-7.86,5.5-10.25,3.67-2.38,8.79-3.57,15.37-3.57,7.27,0,12.94,1.46,17.01,4.37s6.11,7.13,6.11,12.64h-14.29c0-4.57-2.91-6.86-8.74-6.86-2.07,0-3.7.35-4.89,1.03-1.19.69-1.79,1.6-1.79,2.73,0,1.94,1.72,3.35,5.17,4.23l11.09,2.73c4.32,1.07,7.79,2.71,10.39,4.94,2.6,2.22,3.9,5.34,3.9,9.35,0,4.58-1.83,8.07-5.5,10.48-3.67,2.41-9.1,3.62-16.31,3.62-8.02,0-14.1-1.54-18.24-4.61Z"/>
+    <path d="M587.56,69.23h14.29v40.04l18.89-18.33h17.48l-23.59,23.03,23.5,24.35h-17.39l-18.89-19.93v19.93h-14.29v-69.09Z"/>
+  </g>
+</svg>

.renovate/config.yaml

@@ -32,7 +32,7 @@ repositories:
     # Commit type to use if Semantic Commits are enabled (default: "chore")
     semanticCommitType: "chore"
     # Enable dependency dashboard
-    dependencyDashboard: true
+    dependencyDashboard: false
     # Include package files only within these defined paths
     includePaths:
       - "helmfile/environments/default/images.yaml.gotmpl"
@@ -59,30 +59,47 @@ repositories:
       - matchDatasources: [ "docker" ]
         matchDepTypes: [ "openDesk" ]
         groupName: "Platform"
+        groupSlug: "platform"
+        branchTopic: "platform"
       - matchDatasources: [ "docker" ]
         matchDepTypes: [ "Collabora" ]
         groupName: "Collabora"
+        groupSlug: "collabora"
+        branchTopic: "collabora"
       - matchDatasources: [ "docker" ]
         matchDepTypes: [ "Element" ]
         groupName: "Element"
+        groupSlug: "element"
+        branchTopic: "element"
       - matchDatasources: [ "docker" ]
         matchDepTypes: [ "Nordeck" ]
         groupName: "Nordeck"
+        groupSlug: "nordeck"
+        branchTopic: "nordeck"
       - matchDatasources: [ "docker" ]
         matchDepTypes: [ "Open-Xchange" ]
         groupName: "Open-Xchange"
+        groupSlug: "openxchange"
+        branchTopic: "openxchang"
       - matchDatasources: [ "docker" ]
         matchDepTypes: [ "OpenProject" ]
         groupName: "OpenProject"
+        groupSlug: "openproject"
+        branchTopic: "openproject"
       - matchDatasources: [ "docker" ]
-        matchDepTypes: [ "OpenProject" ]
-        groupName: "OpenProject"
+        matchDepTypes: [ "Nextcloud" ]
+        groupName: "nextcloud"
+        branchTopic: "nextcloud"
       - matchDatasources: [ "docker" ]
         matchDepTypes: [ "Univention" ]
         groupName: "Univention"
+        groupSlug: "univention"
+        branchTopic: "univention"
       - matchDatasources: [ "docker" ]
         matchDepTypes: [ "XWiki" ]
         groupName: "XWiki"
+        groupSlug: "xwiki"
+        branchTopic: "xwiki"
     # Add merge request labels
     labels:
       - "renovate"

CHANGELOG.md

@@ -1,3 +1,146 @@
+## [1.3.2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.3.1...v1.3.2) (2025-05-06)
+
+
+### Bug Fixes
+
+* **dovecot:** Update Helm chart to fix migration mode ([7ba84b9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7ba84b99caf61e5a4a35b71d875e9ede0f71423e))
+* **helmfile:** Explicitly template auth-modules in OX App Suite; Streamline name of OX App Suite EE image ([6cbb6b6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6cbb6b6922864467ca365bcc9b1cfa49182df050))
+
+## [1.3.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.3.0...v1.3.1) (2025-04-24)
+
+
+### Bug Fixes
+
+* **ci:** Update Helm to v3.17.3 ([9446faa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9446faaa597777e9fb15d33953e02fdbfef646b2))
+* **ci:** Update Helm to v3.17.3 ([d794a20](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d794a2036ed6543bf89a0b661cc8a4c8a383a5f0))
+* **docs:** Update "Ingress controller" section and add footnote on volume provisioner in `requirements.md` ([17efbd7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/17efbd79f177f635885735823696a6e50b919d3e))
+* **helmfile:** Conditional templating of additional annotations in selected components to unblock openDesk deployment despite a bug in Helm 3.17 (https://github.com/helm/helm/issues/30587) ([861b84b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/861b84b14de9fb42c483f3ddb9e083305750d137))
+* **postfix:** Disable unauthenticated relaying of mails in `postfix-ox` ([7414f05](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7414f05005e019f2121e8458fe63e795819fe92c))
+
+# [1.3.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.2.1...v1.3.0) (2025-04-22)
+
+
+### Bug Fixes
+
+* **helmfile:** Fix Kyverno lint issues for EE components ([46b3834](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/46b38342d3cb6789e1734cd6eba412bc726c834b))
+* **helmfile:** Remove no longer used `secrets.nubus.defaultAccounts.*` ([6e6d155](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6e6d15552e87a77870755db3b48f2af686916c1f))
+* **helmfile:** Support for Keycloak session settings via `functional.authentication.realmSettings.*` ([3fcfa00](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3fcfa00503854f752a3885321b16b3f3597cb09a))
+* **migrations:** Optional delete of `ums-minio-rewrites` Ingress, as it is non-existing in deployments with external object storage ([6932953](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/693295391bb02892b537a48513c9e0c2824ed466))
+* **ox-connector:** Update to v0.19.0 ([fe664a7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fe664a7f8d696fea53b6abadec5a0cb5db751f43))
+* **xwiki:** Update Helm chart to v1.4.4 to fix the problem with XWiki not starting when secrets contained specific (XML interpreted) characters ([67a1df0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/67a1df0f80dc598287174a8dd6bda3f477227f0d))
+
+
+### Features
+
+* **collabora:** Update to 24.04.13 ([8f12208](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8f12208074b2947ec65ebc3c21920d4f775e0c6e))
+* **helmfile:** Add template support for annotations ([9cde57d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9cde57d74b8cfdd09e4f6b82cf45f1b1a686e035))
+* **helmfile:** Support for SSO federation; see `ssoFederation` section in `functional.yaml.gotmpl` for details ([79975a5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/79975a58e3a4f50e59d1d790045c22a32ab49372))
+* **nubus:** Show openDesk version to all users (instead of admin users only) ([393ee31](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/393ee311630630fd1aae8354ead90bcaaf5e4dba))
+* **nubus:** Update to 1.8.0 ([90c49f6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/90c49f6f83df0b34b86c17164eaa4e137d0cd9be))
+* **openproject:** Update to 15.5.0 ([7f1cfc5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7f1cfc55551f608603e0401dfef24bbb9cc334e5))
+
+## [1.2.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.2.0...v1.2.1) (2025-03-28)
+
+
+### Bug Fixes
+
+* **dovecot:** Support external secrets ([f758685](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f758685a2eb4c04bad6bce103cc5ba273c80606d))
+* **element:** Update Synapse to 1.127.1; Fixes https://www.cve.org/CVERecord?id=CVE-2025-30355 which applies to Synapse installations with unrestricted (no allow list) federation enabled ([5cd12b9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5cd12b91c78269b84749280e71aee0fcb195da17))
+* **openproject:** Update to 15.4.2 ([aa8e30b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/aa8e30b34f24302c756b2297b05e138d15ed0d2d))
+
+# [1.2.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.2...v1.2.0) (2025-03-25)
+
+
+### Bug Fixes
+
+* **collabora:** Set proper theming for Collabora Online (openDesk EE) ([896b3c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/896b3c102cd59a9c4d0ae28457261a4749b37a6d))
+* **collabora:** Update to 24.04.12 ([4296db7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4296db7c90c93c3c268a7642ae920d412cb70429))
+* **dev-tooling:** Fix path names when refencing local Helm chart copies in `helmfile-child.yaml.gotmpl` files ([60f5e36](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/60f5e36b7cf183ac9f15b0e56b486e642c54ac4d))
+* **docs:** Add `functional.md` and reference it in `getting-started.md` ([0efc0af](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0efc0af761703a63392034df3f34acf569174e0c))
+* **docs:** Add testing.md ([c4e4258](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c4e425816272951082fa15f1ab4ff4aee4a4598d))
+* **dovecot:** Update EE Helm chart to resolve issue with mandatory set `PriorityClass` ([696f2da](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/696f2daa9c3df6b0db744d81bd6e159b3f9be440))
+* **element:** Run UVS container as a non-root user ([f262507](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f26250774e4bdb157181c3c8fe5c51f7429771ed))
+* **element:** Update NeoChoice and NeoBoard widget to latest releases ([7456543](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7456543d81625599372f781f963fe5902f969627))
+* **helmfile:** Add missing `deletePodsOnSuccessTimeout` statements ([87144b8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/87144b8fd3268ad8196673999241ed1a1bf234fa))
+* **helmfile:** Support for `functional.externalServices.matrix.federation.domainAllowList` ([817af98](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/817af98fcdf9bca0028365796fb17a8cd5d9f4f9))
+* **intercom:** Allow transient session cookies and rolling session duration configuration ([4d59d12](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4d59d12a9703e05cb6bc47fe413ebcaafdcb4c8b))
+* **intercom:** Update to Intercom Service v2.10.3 ([7b05213](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7b05213d6eaa96717e368bc68b79af44c9b3d921))
+* **jitsi:** Update chart to v3.1.0 incl. a fix in room history toggle ([1480253](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1480253a52e5a9848b626f60b7fb75ad7c43c4a5))
+* **migrations:** Explicit scoping of role required for access to the migration's ConfigMap ([02488fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02488fe2dd84046735bdb9351e47d4508eaf191f))
+* **nextcloud:** Disable integration with OX App Suite if groupware it is not available ([fdfe76c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fdfe76c37e597534b2a8b4bf609e28628aabff3e))
+* **nextcloud:** Update apps and support branding of the HTML title ([bc55f6a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc55f6a366398aae497bde8d81b9663b04f992de))
+* **nextcloud:** Update images for improved log output ([f1147f0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f1147f0fdf12271c47225f81069013afdf8bd5f3))
+* **nextcloud:** Update images to allow logging in environments where inotify cannot be used ([0110675](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/01106757da8d8d5a60629126a794c1d61d850f0b))
+* **nextcloud:** Update to 30.0.6 including latest apps ([52b0b13](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/52b0b13e6bf4be738bd29029d1f2940e93a99045))
+* **nubus:** Add imagePullSecrets to nginx-s3-gateway ([466b70a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/466b70a9bb9bbbaf25c920fcca965388eb4d0350))
+* **nubus:** Add migrations for Nubus 1.7.0; See migrations.md for details ([7d7e9e6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7d7e9e65b32e6445b45edcb8bf15f64f79d63a2f))
+* **nubus:** Always use S3 gateway for assets ([1e62a0d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1e62a0dfe14ccd840e910d6aea79fb7beabb8da5))
+* **nubus:** Change logo URLs for apps referencing the openDesk logo provided by Nubus ([5d398f5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5d398f5d64fd03ad9e9a3898424f485fef8888b1))
+* **nubus:** Cleanup of unnecessary LDAP groups; customization option to show the OX App Suite context selection in the IAM's admin UI ([4c42ed7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4c42ed76e82fc0cd517a7409e21cadb757fdac8a))
+* **nubus:** Delete now legacy Ingress `ums-minio-rewrites` ([1c50aa5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1c50aa5ce2ffef4446b28504c461faf84ef856c8))
+* **nubus:** Fix mixed up links for legal and privacy statement ([dbcc785](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dbcc785134a79ebe500724739338702c5e6772a3))
+* **nubus:** Indent `nubusPortalConsumer.persistence.groupMembershipCache` causing `persistence.storages.nubusPortalConsumer.*` to be ignored; See migrations.md for details ([baa5b14](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/baa5b14551f405a5e17ddfc62733c98868a1f205))
+* **nubus:** Register OX provisioning consumer only when OX is enabled; See migrations.md for details ([adb3fa1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/adb3fa18eb36de91927c8118493038b400ff77d5))
+* **nubus:** Remove unnecessary inactive portal tiles and folders ([1724fa1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1724fa14a3fcab9473da06f7702eb248eef334c6))
+* **nubus:** Update openDesk customizing: Preset openDesk specific attributes on `Administrator` account; Remove unused portal categories ([6edfe72](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6edfe7239fd3916be71f830543c01084100b8aba))
+* **opendesk-services:** Add notes to certificate resource ([d18abb0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d18abb0d0a2e011065a6c40f80f56bbdb5a48a90))
+* **openproject:** Update `opendesk-openproject-bootstrap` to support external secrets ([41e0aae](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/41e0aaeffec3e0b4f83662b4381713d2480533fc))
+* **openproject:** Update to 15.3.0 including update for seeding relevant environment variables ([a6de1fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a6de1fe694e7cbee88db5a0688b60e7c8d8e4cff))
+* **openproject:** Update to 15.3.1 ([f34a4a3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f34a4a360178f3a54cfe45198c4717241a9c5289))
+* **openproject:** Update to 15.3.2 ([6723a34](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6723a34c229fb683d5adb1c8c900afb0c3f24087))
+* **openproject:** Update to 15.4.0 ([2a0f2a3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2a0f2a33330e149f8b4b26a3b3c5273274b2c0ca))
+* **openproject:** Update to 15.4.1 ([747cae5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/747cae545abf186b8ec19b5203cdf47c67667601))
+* **openxchange:** Template HTML title from `.Values.theme.texts.productName` ([2e992fc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2e992fc23606a497d770e44fb3afeada1f5d54dd))
+* **openxchange:** Update to latest 8.35 patch level ([44c2081](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/44c2081bd860bd66204d2648f287fc6c5b928faa))
+* **ox-connector:** Update to v0.14.7 ([dd3b35b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dd3b35b626d860389fad4fc0541dc962fe51c060))
+* **postfix:** Add internal authentication ([2389d59](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2389d597358f53e43be5982e29125eabda94bf6c))
+* **postfix:** Add recipient delimiter support ([f92b76b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f92b76b2b28c7955123f83881d23f719ea8dfd5c))
+* **requirements.md:** Set Ingress NGINX 1.11.5 as requirement ([2bf8e1d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2bf8e1de9873e15501b282d8e0d16350559e54dd))
+* **synapse:** Use synapse-guest-module by Element (supplier) ([2730b03](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2730b03e701922c3b14fdd5f8e8dfb64223b3edc))
+
+
+### Features
+
+* **helmfile:** Use PostgreSQL as default database for Nextcloud and XWiki;  follow `migrations.md` when upgrading an existing environment ([2f584bd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2f584bd8e82ab7262659d6b24613f214f6e9ad25))
+* **nextcloud:** Support external secrets for metrics token ([dbec2ec](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dbec2ec36f5019bc0f5e9769ab02701ebac4aa2c))
+* **notes:** Update to v2.4.0 ([3d35440](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d35440dc76c703872488ec468649ed274099fd5))
+* **nubus:** Support of external secrets in opendesk-keycloak-bootstrap ([3d2f751](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d2f75165a571a67d08f7e9588297c70fc808179))
+* **nubus:** Update to v1.7.0 ([d018385](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d018385473df1f5154e15ca8c55145d10e713797))
+* **openxchange:** Update to OX App Suite 8.35 ([037537b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/037537b394b2e07aa05590c8bcf7c1145df7d7e9))
+* **xwiki:** Update to 16.10.5 ([bfd27f3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bfd27f3c396d6f05ed3e6dd4cd9f2ff424250da8))
+
+## [1.1.2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.1...v1.1.2) (2025-02-19)
+
+
+### Bug Fixes
+
+* **dovecot:** Add Dovecot Pro [EE] ([6e343c7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6e343c76a32a5bf4b431bdad6be1f7d107caa4f5))
+* **element:** Add Element EE components ([61d94a8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/61d94a8de655d1289aaf59c42f0dbf30b0156e1f))
+* **helmfile:** Add missing customizing option for Matrix widgets ([9c79c44](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9c79c44453af7b0c68f4ee2a5e40f1f9fb298570))
+* **helmfile:** Add SSL option for Keycloak Extensions Proxy's PostgreSQL connection ([91d0f98](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/91d0f9868226b08128af518be741c8614342581e))
+* **helmfile:** Fine-grained service types ([de8b560](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/de8b560fe7e2294229a959398be60bec9b6a7790))
+* **helmfile:** Integrate oD EE ([03ec704](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/03ec70435c365eca9f555a195b7ab92cc9eee907))
+* **helmfile:** Introduce `apps` as top level in `opendesk_main.yaml.gotmpl`; Please check migrations.md for upgrades of existing installations ([2fcf014](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2fcf014894ac3356ef8c6e57dda30c5176172e5e))
+* **helmfile:** Make openDesk IAM attributes optional with enabled as default ([b32996d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b32996da347c7ec24fb53afe72fee8c07631bebe))
+* **helmfile:** Provide toggle in `functional.yaml.gotmpl` for "new device notification" mails ([284c9fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/284c9fe0c7e217e3f92ec70eaad6ccf593ff2a87))
+* **helmfile:** Remove reference to no longer required `elementWeb` chart ([cd9c54b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cd9c54b17733f9e334c558ccd86e69677264970a))
+* **helmfile:** Set default for domain to `opendesk.internal` to avoid enforcing DOMAIN environment variable for deployments using YAML overrides ([930ae9d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/930ae9d3e71bcd3f4034aa4dae5eabb3ae04d11b))
+* **helmfile:** Update/streamline theming ([8eeaa23](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8eeaa23c2f68e8e0cbda5b3763ab15ba8262c48d))
+* **jitsi:** Support for phone dial-in into Jitsi conferences ([1323ef1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1323ef142e789820acb05cb4991d10502a35498b))
+* **nextcloud:** Update `groupfolders` app to fix group selection in admin mode ([ab49bf9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ab49bf9f6bb945cdce3950e46382b7361c48e6e4))
+* **nextcloud:** Update Nextcloud to 29.0.11 and support for Cron-Job specific resource definitions ([09f4829](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/09f482981b96774b3fe0948b7bb120be90157148))
+* **nubus:** Disable unused notification feature ([955f17e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/955f17ef8bb72459beb536cdcf6b502b16eabbff))
+* **nubus:** Fix Keycloak dialogue background length on small screens ([4662709](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/466270967310fab9333b892c904efa86d21f7d17))
+* **nubus:** Only configure apps that are deployed to show up in IAM admin UI and Keycloak ([1f051e7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1f051e777905668297c98dfa507875c08158bfda))
+* **nubus:** Re-implement toggle for UDM-REST-API based on `functional.externalServices.nubus.udmRestApi.enabled` ([777e7d2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/777e7d2fc6afa9c53a4ff1c6853c9960b9a22d5f))
+* **nubus:** Remove doublet `resources` key in `udm-listener` StatefulSet ([10e0b0a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/10e0b0ad6cbd89bd88b119f17b6cba6ec698f698))
+* **nubus:** Support for custom UDM commands ([aff8edb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/aff8edbde2150763d6a36f97b9403c8c67e51fab))
+* **nubus:** Update Keycloak Extensions Proxy ([601e649](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/601e6499132c3adaaaea374033511eab09132cb2))
+* **open-xchange:** Parameters to split read and write queries to MariaDB ([370247b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/370247b95197792a65b84b2d01b9c1806f8b059a))
+* **open-xchange:** Update OX App Suite to 8.33 ([581c8ae](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/581c8aed1f86bad251141ecb105e59d0054d5a1a))
+* **openproject:** Update OpenProject to 15.2.1 ([83c311b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/83c311b101a6fa551d9c25ea4e9a7ef6673137ca))
+* **oxconnector:** Update to strict `securityContext` from upstream defaults ([32df165](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/32df1657d29a2d73495d52b62bb77521cb8b8e86))
+
 ## [1.1.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.0...v1.1.1) (2025-01-27)
 
 

CONTRIBUTING.md

@@ -5,19 +5,19 @@ SPDX-License-Identifier: Apache-2.0
 
 # Read me first
 
-Please read the [project's overall CONTRIBUTING.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/CONTRIBUTING.md) first.
+Please read the [project's entire CONTRIBUTING.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/CONTRIBUTING.md) first.
 
 # How to contribute?
 
-Please also read the [project's workflow documentation](./docs/workflow.md) for more details on standards like commit
-messages and branching.
+Please also read the [project's workflow documentation](./docs/developer/workflow.md) for more details on standards like commit
+messages and branching convention.
 
 ## Helm vs. Operators vs. Manifests
 
 Due to DVS requirements:
 
 - we have to use [Helm charts](https://helm.sh/) (that can consist of Manifests).
-- we should avoid stand alone Manifests.
+- we should avoid stand-alone Manifests.
 - we do not use Operators and CRDs.
 
 In order to align the Helm files from various sources into the unified deployment of openDesk we make use of
@@ -25,13 +25,12 @@ In order to align the Helm files from various sources into the unified deploymen
 
 ## Tooling
 
-We should not introduce a new tool without sharing the purpose with the team and let the team decide if the tool should
-be used.
+New tools should not be introduced without first discussing it with the team. A proposal is fine, but let the team decide if the tool should
+be used or not.
 
 We should avoid adding unnecessary complexity.
 
 ## In doubt? Ask!
 
-We are always happy about contributions, but also like to discuss technical approaches to solve a problem to ensure
-a contribution fits the openDesk platform strategy or clarify that specific topics might be must ahead on our own
-roadmap. So when in doubt please [open an issue](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/issues/new) and start a discussion.
+We are always happy to receive contributions, but we also like to discuss technical approaches in order to solve a problem. This helps to ensure
+a contribution fits the openDesk platform strategy and roadmap, and potentially avoids otherwise wasted time. So when in doubt please [open an issue](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/issues/new) and start a discussion.

LICENSES/CC-BY-SA-4.0.txt

@@ -0,0 +1,170 @@
+Creative Commons Attribution-ShareAlike 4.0 International
+
+ Creative Commons Corporation (“Creative Commons”) is not a law firm and does not provide legal services or legal advice. Distribution of Creative Commons public licenses does not create a lawyer-client or other relationship. Creative Commons makes its licenses and related information available on an “as-is” basis. Creative Commons gives no warranties regarding its licenses, any material licensed under their terms and conditions, or any related information. Creative Commons disclaims all liability for damages resulting from their use to the fullest extent possible.
+
+Using Creative Commons Public Licenses
+
+Creative Commons public licenses provide a standard set of terms and conditions that creators and other rights holders may use to share original works of authorship and other material subject to copyright and certain other rights specified in the public license below. The following considerations are for informational purposes only, are not exhaustive, and do not form part of our licenses.
+
+Considerations for licensors: Our public licenses are intended for use by those authorized to give the public permission to use material in ways otherwise restricted by copyright and certain other rights. Our licenses are irrevocable. Licensors should read and understand the terms and conditions of the license they choose before applying it. Licensors should also secure all rights necessary before applying our licenses so that the public can reuse the material as expected. Licensors should clearly mark any material not subject to the license. This includes other CC-licensed material, or material used under an exception or limitation to copyright. More considerations for licensors.
+
+Considerations for the public: By using one of our public licenses, a licensor grants the public permission to use the licensed material under specified terms and conditions. If the licensor’s permission is not necessary for any reason–for example, because of any applicable exception or limitation to copyright–then that use is not regulated by the license. Our licenses grant only permissions under copyright and certain other rights that a licensor has authority to grant. Use of the licensed material may still be restricted for other reasons, including because others have copyright or other rights in the material. A licensor may make special requests, such as asking that all changes be marked or described.
+
+Although not required by our licenses, you are encouraged to respect those requests where reasonable. More considerations for the public.
+
+Creative Commons Attribution-ShareAlike 4.0 International Public License
+
+By exercising the Licensed Rights (defined below), You accept and agree to be bound by the terms and conditions of this Creative Commons Attribution-ShareAlike 4.0 International Public License ("Public License"). To the extent this Public License may be interpreted as a contract, You are granted the Licensed Rights in consideration of Your acceptance of these terms and conditions, and the Licensor grants You such rights in consideration of benefits the Licensor receives from making the Licensed Material available under these terms and conditions.
+
+Section 1 – Definitions.
+
+     a.	Adapted Material means material subject to Copyright and Similar Rights that is derived from or based upon the Licensed Material and in which the Licensed Material is translated, altered, arranged, transformed, or otherwise modified in a manner requiring permission under the Copyright and Similar Rights held by the Licensor. For purposes of this Public License, where the Licensed Material is a musical work, performance, or sound recording, Adapted Material is always produced where the Licensed Material is synched in timed relation with a moving image.
+
+     b.	Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License.
+
+     c.	BY-SA Compatible License means a license listed at creativecommons.org/compatiblelicenses, approved by Creative Commons as essentially the equivalent of this Public License.
+
+     d.	Copyright and Similar Rights means copyright and/or similar rights closely related to copyright including, without limitation, performance, broadcast, sound recording, and Sui Generis Database Rights, without regard to how the rights are labeled or categorized. For purposes of this Public License, the rights specified in Section 2(b)(1)-(2) are not Copyright and Similar Rights.
+
+     e.	Effective Technological Measures means those measures that, in the absence of proper authority, may not be circumvented under laws fulfilling obligations under Article 11 of the WIPO Copyright Treaty adopted on December 20, 1996, and/or similar international agreements.
+
+     f.	Exceptions and Limitations means fair use, fair dealing, and/or any other exception or limitation to Copyright and Similar Rights that applies to Your use of the Licensed Material.
+
+     g.	License Elements means the license attributes listed in the name of a Creative Commons Public License. The License Elements of this Public License are Attribution and ShareAlike.
+
+     h.	Licensed Material means the artistic or literary work, database, or other material to which the Licensor applied this Public License.
+
+     i.	Licensed Rights means the rights granted to You subject to the terms and conditions of this Public License, which are limited to all Copyright and Similar Rights that apply to Your use of the Licensed Material and that the Licensor has authority to license.
+
+     j.	Licensor means the individual(s) or entity(ies) granting rights under this Public License.
+
+     k.	Share means to provide material to the public by any means or process that requires permission under the Licensed Rights, such as reproduction, public display, public performance, distribution, dissemination, communication, or importation, and to make material available to the public including in ways that members of the public may access the material from a place and at a time individually chosen by them.
+
+     l.	Sui Generis Database Rights means rights other than copyright resulting from Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, as amended and/or succeeded, as well as other essentially equivalent rights anywhere in the world.
+
+     m.	You means the individual or entity exercising the Licensed Rights under this Public License. Your has a corresponding meaning.
+
+Section 2 – Scope.
+
+     a.	License grant.
+
+          1. Subject to the terms and conditions of this Public License, the Licensor hereby grants You a worldwide, royalty-free, non-sublicensable, non-exclusive, irrevocable license to exercise the Licensed Rights in the Licensed Material to:
+
+               A. reproduce and Share the Licensed Material, in whole or in part; and
+
+               B. produce, reproduce, and Share Adapted Material.
+
+          2. Exceptions and Limitations. For the avoidance of doubt, where Exceptions and Limitations apply to Your use, this Public License does not apply, and You do not need to comply with its terms and conditions.
+
+          3. Term. The term of this Public License is specified in Section 6(a).
+
+          4. Media and formats; technical modifications allowed. The Licensor authorizes You to exercise the Licensed Rights in all media and formats whether now known or hereafter created, and to make technical modifications necessary to do so. The Licensor waives and/or agrees not to assert any right or authority to forbid You from making technical modifications necessary to exercise the Licensed Rights, including technical modifications necessary to circumvent Effective Technological Measures. For purposes of this Public License, simply making modifications authorized by this Section 2(a)(4) never produces Adapted Material.
+
+          5. Downstream recipients.
+
+               A. Offer from the Licensor – Licensed Material. Every recipient of the Licensed Material automatically receives an offer from the Licensor to exercise the Licensed Rights under the terms and conditions of this Public License.
+
+               B. Additional offer from the Licensor – Adapted Material. Every recipient of Adapted Material from You automatically receives an offer from the Licensor to exercise the Licensed Rights in the Adapted Material under the conditions of the Adapter’s License You apply.
+
+               C. No downstream restrictions. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, the Licensed Material if doing so restricts exercise of the Licensed Rights by any recipient of the Licensed Material.
+
+          6. No endorsement. Nothing in this Public License constitutes or may be construed as permission to assert or imply that You are, or that Your use of the Licensed Material is, connected with, or sponsored, endorsed, or granted official status by, the Licensor or others designated to receive attribution as provided in Section 3(a)(1)(A)(i).
+
+     b.	Other rights.
+
+          1. Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, privacy, and/or other similar personality rights; however, to the extent possible, the Licensor waives and/or agrees not to assert any such rights held by the Licensor to the limited extent necessary to allow You to exercise the Licensed Rights, but not otherwise.
+
+          2. Patent and trademark rights are not licensed under this Public License.
+
+          3. To the extent possible, the Licensor waives any right to collect royalties from You for the exercise of the Licensed Rights, whether directly or through a collecting society under any voluntary or waivable statutory or compulsory licensing scheme. In all other cases the Licensor expressly reserves any right to collect such royalties.
+
+Section 3 – License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the following conditions.
+
+     a.	Attribution.
+
+          1. If You Share the Licensed Material (including in modified form), You must:
+
+               A. retain the following if it is supplied by the Licensor with the Licensed Material:
+
+                    i.	identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated);
+
+                    ii.	a copyright notice;
+
+                    iii. a notice that refers to this Public License;
+
+                    iv.	a notice that refers to the disclaimer of warranties;
+
+                    v.	a URI or hyperlink to the Licensed Material to the extent reasonably practicable;
+
+               B. indicate if You modified the Licensed Material and retain an indication of any previous modifications; and
+
+               C. indicate the Licensed Material is licensed under this Public License, and include the text of, or the URI or hyperlink to, this Public License.
+
+          2. You may satisfy the conditions in Section 3(a)(1) in any reasonable manner based on the medium, means, and context in which You Share the Licensed Material. For example, it may be reasonable to satisfy the conditions by providing a URI or hyperlink to a resource that includes the required information.
+
+          3. If requested by the Licensor, You must remove any of the information required by Section 3(a)(1)(A) to the extent reasonably practicable.
+
+     b.	ShareAlike.In addition to the conditions in Section 3(a), if You Share Adapted Material You produce, the following conditions also apply.
+
+          1. The Adapter’s License You apply must be a Creative Commons license with the same License Elements, this version or later, or a BY-SA Compatible License.
+
+          2. You must include the text of, or the URI or hyperlink to, the Adapter's License You apply. You may satisfy this condition in any reasonable manner based on the medium, means, and context in which You Share Adapted Material.
+
+          3. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply.
+
+Section 4 – Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that apply to Your use of the Licensed Material:
+
+     a.	for the avoidance of doubt, Section 2(a)(1) grants You the right to extract, reuse, reproduce, and Share all or a substantial portion of the contents of the database;
+
+     b.	if You include all or a substantial portion of the database contents in a database in which You have Sui Generis Database Rights, then the database in which You have Sui Generis Database Rights (but not its individual contents) is Adapted Material, including for purposes of Section 3(b); and
+
+     c.	You must comply with the conditions in Section 3(a) if You Share all or a substantial portion of the contents of the database.
+For the avoidance of doubt, this Section 4 supplements and does not replace Your obligations under this Public License where the Licensed Rights include other Copyright and Similar Rights.
+
+Section 5 – Disclaimer of Warranties and Limitation of Liability.
+
+     a.	Unless otherwise separately undertaken by the Licensor, to the extent possible, the Licensor offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Material, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not known or discoverable. Where disclaimers of warranties are not allowed in full or in part, this disclaimer may not apply to You.
+
+     b.	To the extent possible, in no event will the Licensor be liable to You on any legal theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of this Public License or use of the Licensed Material, even if the Licensor has been advised of the possibility of such losses, costs, expenses, or damages. Where a limitation of liability is not allowed in full or in part, this limitation may not apply to You.
+
+     c.	The disclaimer of warranties and limitation of liability provided above shall be interpreted in a manner that, to the extent possible, most closely approximates an absolute disclaimer and waiver of all liability.
+
+Section 6 – Term and Termination.
+
+     a.	This Public License applies for the term of the Copyright and Similar Rights licensed here. However, if You fail to comply with this Public License, then Your rights under this Public License terminate automatically.
+
+     b.	Where Your right to use the Licensed Material has terminated under Section 6(a), it reinstates:
+
+          1. automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the violation; or
+
+          2. upon express reinstatement by the Licensor.
+
+     c.	For the avoidance of doubt, this Section 6(b) does not affect any right the Licensor may have to seek remedies for Your violations of this Public License.
+
+     d.	For the avoidance of doubt, the Licensor may also offer the Licensed Material under separate terms or conditions or stop distributing the Licensed Material at any time; however, doing so will not terminate this Public License.
+
+     e.	Sections 1, 5, 6, 7, and 8 survive termination of this Public License.
+
+Section 7 – Other Terms and Conditions.
+
+     a.	The Licensor shall not be bound by any additional or different terms or conditions communicated by You unless expressly agreed.
+
+     b.	Any arrangements, understandings, or agreements regarding the Licensed Material not stated herein are separate from and independent of the terms and conditions of this Public License.
+
+Section 8 – Interpretation.
+
+     a.	For the avoidance of doubt, this Public License does not, and shall not be interpreted to, reduce, limit, restrict, or impose conditions on any use of the Licensed Material that could lawfully be made without permission under this Public License.
+
+     b.	To the extent possible, if any provision of this Public License is deemed unenforceable, it shall be automatically reformed to the minimum extent necessary to make it enforceable. If the provision cannot be reformed, it shall be severed from this Public License without affecting the enforceability of the remaining terms and conditions.
+
+     c.	No term or condition of this Public License will be waived and no failure to comply consented to unless expressly agreed to by the Licensor.
+
+     d.	Nothing in this Public License constitutes or may be interpreted as a limitation upon, or waiver of, any privileges and immunities that apply to the Licensor or You, including from the legal processes of any jurisdiction or authority.
+
+Creative Commons is not a party to its public licenses. Notwithstanding, Creative Commons may elect to apply one of its public licenses to material it publishes and in those instances will be considered the “Licensor.” Except for the limited purpose of indicating that material is shared under a Creative Commons public license or as otherwise permitted by the Creative Commons policies published at creativecommons.org/policies, Creative Commons does not authorize the use of the trademark “Creative Commons” or any other trademark or logo of Creative Commons without its prior written consent including, without limitation, in connection with any unauthorized modifications to any of its public licenses or any other arrangements, understandings, or agreements concerning use of licensed material. For the avoidance of doubt, this paragraph does not form part of the public licenses.
+
+Creative Commons may be contacted at creativecommons.org.

README-EE.md

@@ -6,51 +6,46 @@ SPDX-License-Identifier: Apache-2.0
 <h1>openDesk Enterprise Edition</h1>
 
 <!-- TOC -->
-* [Components](#components)
 * [Enabling the Enterprise deployment](#enabling-the-enterprise-deployment)
 * [Configuring the oD EE deployment for self-hosted installations](#configuring-the-od-ee-deployment-for-self-hosted-installations)
   * [Registry access](#registry-access)
   * [License keys](#license-keys)
+* [Component overview](#component-overview)
+  * [CE Components](#ce-components)
+  * [EE Components](#ee-components)
+    * [Collabora](#collabora)
+    * [Element](#element)
+    * [Nextcloud](#nextcloud)
+    * [Open-Xchange](#open-xchange)
+      * [OX App Suite](#ox-app-suite)
+      * [OX Dovecot](#ox-dovecot)
 <!-- TOC -->
 
 openDesk Enterprise Edition is recommended for production use. It receives support and patches from ZenDiS and the suppliers of the components due to the included product subscriptions.
 
-The document refers to openDesk Community Edition as "oD CE" and for the openDesk Enterprise Edition it is "oD EE".
+This document refers to the openDesk Community Edition as "oD CE" and the openDesk Enterprise Edition as "oD EE".
 
-Please contact [ZenDiS](mailto:opendesk@zendis.de) to get openDesk Enterprise, either as SaaS offering or for you on-premise installation.
-
-# Components
-
-The following components using the same codebase and artifacts for their Enterprise and Community offering:
-- Cryptpad
-- Jitsi
-- Nubus
-- OpenProject
-- XWiki
-
-The following components have - at least partially - Enterprise specific artifacts:
-
-- Collabora: Collabora Online image version `<major>.<minor>.<patch>.3` will be used once available, at the same time the Collabora Development Edition image will be updated to `<major>.<minor>.<patch>.2` for oD CE.
-- Element: Some artifacts providing additional functionality are only available in oD EE. For the shared artifacts we keep the ones in oD CE and oD EE in sync.
-- Nextcloud: Specific enterprise image based on the NC Enterprise package is build based on the same release version as used in oD CE.
-- OX AppSuite: oD CE and EE are using the same release version, in EE an enterprise-built container of the AppSuite's Core-Middleware is being integrated.
-- OX Dovecot Pro 3: Dovecot Pro provides support for S3 storage and this feature is used by default.
+Please contact [ZenDiS](mailto:opendesk@zendis.de) to get openDesk Enterprise, either as a SaaS offering or for your on-premises installation.
 
 # Enabling the Enterprise deployment
 
-To enable the oD EE deployment you must set the environment variable `OPENDESK_ENTERPRISE` to any value.
+To enable the oD EE deployment you must set the environment variable `OPENDESK_ENTERPRISE` to any value that does not evaluate to boolean *false* for [Helm flow control](https://helm.sh/docs/chart_template_guide/control_structures/#ifelse), e.g. `"true"`, `"yes"` or `"1"`:
 
 ```shell
-OPENDESK_ENTERPRISE=any_value
+OPENDESK_ENTERPRISE=true
 ```
 
+> **Note**
+> Upgrading from oD CE to EE is currently not supported, especially due to the fact it requires a migration
+> from Dovecot 2.x (standard storage) to Dovecot Pro 3.x (S3).
+
 # Configuring the oD EE deployment for self-hosted installations
 
 ## Registry access
 
 With openDesk EE you get access to the related artifact registry owned by ZenDiS.
 
-Three steps are required to access the registry - for step #1 and #2 you can set some variables. You can to define a `<your_name_for_the_secret>` freely, like `enterprise-secret`, as long as it consistent in step #1 and #3.
+Three steps are required to access the registry - for step #1 and #2 you can set some variables. Below, you can define `<your_name_for_the_secret>` freely, like `enterprise-secret`, as long as it consistent in step #1 and #3.
 
 ```shell
 NAMESPACE=<your_namespace>
@@ -59,7 +54,7 @@ YOUR_ENTERPRISE_REGISTRY_USERNAME=<your_registry_credential_username>
 YOUR_ENTERPRISE_REGISTRY_PASSWORD=<your_registry_credential_password>
 ```
 
-1. Add your registry credentials as secret to the namespace you want to deploy openDesk to. Do not forget to create the namespace if it does not exist yet (`kubectl create namespace ${NAMESPACE}`).
+1. Add your registry credentials as a secret to the namespace you want to deploy openDesk to. Do not forget to create the namespace if it does not exist yet (`kubectl create namespace ${NAMESPACE}`).
 
 ```shell
 kubectl create secret --namespace "${NAMESPACE}" \
@@ -100,3 +95,58 @@ Details regarding the scope/limitation of the component's licenses:
 - Nextcloud: Enterprise license to enable [Nextcloud Enterprise](https://nextcloud.com/de/enterprise/) specific features, can be used across multiple installations until the licensed number of users is reached.
 - OpenProject: Domain specific enterprise license to enable [OpenProject's Enterprise feature set](https://www.openproject.org/enterprise-edition/), domain matching can use regular expressions.
 - XWiki: Deployment specific enterprise license (key pair) to activate the [XWiki Pro](https://xwiki.com/en/offerings/products/xwiki-pro) apps.
+
+# Component overview
+
+## CE Components
+
+The following components are using the same codebase and artifacts for their Enterprise and Community offering:
+
+- Cryptpad
+- Jitsi
+- Notes
+- Nubus
+- OpenProject
+- XWiki
+
+## EE Components
+
+This section provides information about the components that have - at least partially - Enterprise specific artifacts.
+
+If you want to check in detail which artifacts are specific to openDesk Enterprise and thereby may contain proprietary code, please check the `repository:`
+values in the image ([1](./helmfile/environments/default/images.yaml.gotmpl) / [2](./helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl))
+and chart ([1](./helmfile/environments/default/charts.yaml.gotmpl) / [2](./helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl)) definitions.
+When a repository path starts with `/zendis`, the artifact is only available in an openDesk Enterprise deployment.
+
+###  Collabora
+
+- Collabora Online (COOL) container image: Is build from the same public source code as Collabora Development Edition (CODE), only the build configurations might differ. COOL includes a brand package that is not public and its license is not open source.
+- COOL Controller container image and Helm chart: Source code and chart are using Mozilla Public License Version 2.0, but the source code is not public. It is provided to customers upon request.
+
+openDesk updates Collabora once a COOL image based on the version pattern `<major>.<minor>.<patch>.3+.<build>` was made available. This happens usually at the same time the CODE image with `<major>.<minor>.<patch>.2+.<build>` is made available.
+
+### Element
+
+- AdminBot and GroupSync container image: 100% closed source
+- Admin Console container image: 100% closed source, though ~65% of the total runtime code is from the [matrix-bot-sdk](https://github.com/turt2live/matrix-bot-sdk/)
+
+### Nextcloud
+
+- Nextcloud Enterprise: openDesk uses the Nextcloud Enterprise to the build Nextcloud container image for oD EE. The Nextcloud EE codebase might contain EE exclusive (longterm support) security patches, plus the Guard app, that is not publicly available, while it is AGPL-3.0 licensed.
+
+openDesk updates the Nextcloud images for openDesk CE and EE in parallel, therefore we will not upgrade to a new major Nextcloud release before the related Nextcloud Enterprise release is available. When patches are released exclusively for Nextcloud Enterprise, they are made available also exclusively in oD EE.
+
+### Open-Xchange
+
+#### OX App Suite
+
+- OX App Suite Core Middleware container image: The amount of code, that is not open source and has a proprietary license, is <10%.
+- OX App Suite Pro Helm chart: It is not publicly available, though it is "just" an umbrella chart re-using the publicly available charts referencing the EE images, so it has <10% prorietary content.
+
+openDesk updates OX App Suite in od CE and EE always to the same release version. Only the App Suíte Pro Helm chart has the same versioning as the actual App Suite release, the chart used in oD CE has a different versioning scheme.
+
+#### OX Dovecot
+
+- Dovecot Pro container image: Dovecot Pro is based on the open source components Dovecot and Pigeonhole but extended by modules providing additional functionality like obox2, cluster, cluster controller and dovecot fts. The additional modules make up about 15% of the overall Dovecot Pro code and are subject to a closed source license.
+
+openDesk aims to keep Dovecot's shared codebases in sync between oD CE and EE, though the versioning between the releases differs (CE: 2.x, EE: 3.y).

README.md

@@ -13,6 +13,7 @@ SPDX-License-Identifier: Apache-2.0
 * [Getting started](#getting-started)
 * [Advanced customization](#advanced-customization)
 * [Architecture](#architecture)
+* [Testing](#testing)
 * [Permissions](#permissions)
 * [Releases](#releases)
 * [Data Storage](#data-storage)
@@ -24,26 +25,27 @@ SPDX-License-Identifier: Apache-2.0
 
 # Overview
 
-openDesk is a Kubernetes based, open-source and cloud-native digital workplace suite provided by the
+openDesk is a Kubernetes-based, open-source and cloud-native digital workplace suite provided by the
 *Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH*.
 
-For production use the [openDesk Enterprise Edition](./README-EE.md) is required.
+For production use, the [openDesk Enterprise Edition](./README-EE.md) is recommended.
 
 openDesk currently features the following functional main components:
 
-| Function             | Functional Component        | Component<br/>Version                                                                                | Upstream Documentation                                                                                                                |
-| -------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
-| Chat & collaboration | Element ft. Nordeck widgets | [1.11.89](https://github.com/element-hq/element-desktop/releases/tag/v1.11.89)                       | [For the most recent release](https://element.io/user-guide)                                                                          |
-| Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                                     | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
-| File management      | Nextcloud                   | [29.0.8](https://nextcloud.com/de/changelog/#29-0-8)                                                 | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                           |
-| Groupware            | OX App Suite                | [8.30](https://documentation.open-xchange.com/appsuite/releases/8.30/)                               | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
-| Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)                       | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
-| Portal & IAM         | Nubus                       | [1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
-| Project management   | OpenProject                 | [15.2.0](https://www.openproject.org/docs/release-notes/15-2-0/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
-| Videoconferencing    | Jitsi                       | [2.0.9823](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9823)                | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
-| Weboffice            | Collabora                   | [24.04.9.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                               | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
+| Function             | Functional Component        | Component<br/>Version                                                                                                         | Upstream Documentation                                                                                                                |
+|----------------------|-----------------------------|-------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
+| Chat & collaboration | Element ft. Nordeck widgets | [1.11.89](https://github.com/element-hq/element-desktop/releases/tag/v1.11.89)                                                | [For the most recent release](https://element.io/user-guide)                                                                          |
+| Collaborative notes  | Notes (aka Docs)            | [2.4.0](https://github.com/suitenumerique/docs/releases/tag/v2.4.0)                                                           | Online documentation/welcome document available in installed application                                                              |
+| Diagram editor       | CryptPad ft. diagrams.net   | [2024.9.0](https://github.com/cryptpad/cryptpad/releases/tag/2024.9.0)                                                        | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
+| File management      | Nextcloud                   | [30.0.6](https://nextcloud.com/de/changelog/#30-0-6)                                                                          | [Nextcloud 30](https://docs.nextcloud.com/)                                                                                           |
+| Groupware            | OX App Suite                | [8.35](https://documentation.open-xchange.com/appsuite/releases/8.35/)                                                        | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
+| Knowledge management | XWiki                       | [16.10.5](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.5/)                                              | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
+| Portal & IAM         | Nubus                       | [1.8.0](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html#version-1-8-0-2025-04-07) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
+| Project management   | OpenProject                 | [15.5.1](https://www.openproject.org/docs/release-notes/15-5-1/)                                                              | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Videoconferencing    | Jitsi                       | [2.0.9955](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9955)                                         | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
+| Weboffice            | Collabora                   | [24.04.13](https://www.collaboraoffice.com/code-24-04-release-notes/)                                                         | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
 
-While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
+While not all components are perfectly designed for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
 
 This documentation aims to give you all that is needed to set up your own instance of the openDesk.
@@ -79,18 +81,22 @@ You would like to install openDesk in your own infrastructure?
 
 # Architecture
 
-More information on openDesk's architecture can be found in our [Architecture docs](./docs/architecture.md).
+More information on openDesk's architecture can be found in our [architecture documentation](./docs/architecture.md).
+
+# Testing
+
+openDesk is continuously tested to ensure it meets high quality standards. Read how we test in openDesk in our [testing concept](./docs/testing.md).
 
 # Permissions
 
-Find out more about the permission system in the[roles & permissions concept](./docs/permissions.md)
+Find out more about the permission system in the [roles & permissions concept](./docs/permissions.md)
 
 # Releases
 
-All technical releases are created using [Semantic Versioning](https://semver.org/lang/de/).
+All technical releases are created using [Semantic Versioning](https://semver.org/).
 
 Gitlab provides an
-[overview on the releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases)
+[overview on the releases](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases)
 of this project.
 
 Please find a list of the artifacts related to the release either in the source code archive attached to the release or
@@ -98,7 +104,7 @@ in the files from the release's git-tag:
 - `./helmfile/environments/default/images.yaml.gotmpl`
 - `./helmfile/environments/default/charts.yaml.gotmpl`
 
-Find more information in our [Workflow documentation](./docs/workflow.md).
+Find more information in our [Workflow documentation](./docs/developer/workflow.md).
 
 # Data Storage
 
@@ -109,15 +115,15 @@ More information about different data storages used within openDesk are describe
 
 We love to get feedback from you!
 
-Related to the deployment / contents of this repository,
-please use the [issues within this project](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/issues).
+For feedback related to the deployment / contents of this repository,
+please use the [issues within this project](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues).
 
 If you want to address other topics, please check the section
 ["Rückmeldungen und Beteiligung" in the OVERVIEW.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung) of the [openDesk Info Repository](https://gitlab.opencode.de/bmi/opendesk/info).
 
 # Development
 
-If you want to join or contribute to the development of openDesk please read the [Development guide](./docs/development.md).
+If you want to join or contribute to the development of openDesk please read the [Development guide](./docs/developer/development.md).
 
 # License
 
@@ -125,4 +131,4 @@ This project uses the following license: Apache-2.0
 
 # Copyright
 
-Copyright (C) 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+Copyright (C) 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH

REUSE.toml

@@ -24,6 +24,11 @@ SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentl
 SPDX-License-Identifier = "Apache-2.0"
 
 [[annotations]]
-path = "helmfile/files/portal-tiles/*"
-SPDX-FileCopyrightText = "2024 Google LLC"
-SPDX-License-Identifier = "Apache-2.0"
+path = ".opencode/openDesk-logo-rgb-color.svg"
+SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "CC-BY-SA-4.0"
+
+[[annotations]]
+path = ".opencode/screenshots/*"
+SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "CC-BY-SA-4.0"

dev/README.md

@@ -7,30 +7,40 @@ SPDX-License-Identifier: Apache-2.0
 
 * [charts-local.py](#charts-localpy)
   * [Commandline parameter](#commandline-parameter)
-    * [`--branch`](#--branch)
+    * [`--match <your_string>`](#--match-your_string)
     * [`--revert`](#--revert)
+    * [`--branch` (deprecated)](#--branch-deprecated)
 
 # charts-local.py
 
-This script helps you on cloning the platform development Helm charts and referencing them directly in the openDesk
-Helmfile deployment for comfortable local test and development. The charts will be cloned into a directory
-parallel created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
-The name of the chart directory is derived from the branch name you are working with in this `opendesk` repo.
+This script helps you with cloning/pulling Helm charts and referencing them directly in the openDesk
+Helmfile deployment for comfortable local test and development. The charts will be cloned/pulled into a directory
+created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
 
-The script will create `.bak` copies of the helmfiles that have been touched.
+The name of the directory containing the charts is based on the (currently) selected branch of the openDesk
+repo prefixed with `charts-`.
+
+The script will create `.bak` copies of the helmfiles that have been touched that can easily be reverted to
+using the `--revert` option.
 
 Run the script with `-h` to get information about the script's parameter on commandline.
 
 ## Commandline parameter
 
-### `--branch`
+### `--match <your_string>`
+
+Will only fetch repos or pull images for charts which name matches `<your_string>`.
+
+### `--revert`
+
+Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
+scripts itself back to their original location.
+
+### `--branch` (deprecated)
 
 Optional parameter: Defines a branch for the `opendesk` repo to work with. The script will create the branch if it
 does not exist yet. Otherwise it will switch to defined branch.
 
 If parameter is omitted the current branch of the `opendesk` repo will be used.
 
-### `--revert`
-
-Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
-scripts itself back to their original location.
+As this parameter was used rarely, we might remove the support in a later version.

dev/charts-local.py

@@ -18,7 +18,6 @@ p.add('--branch', env_var='CHART_DEV_BRANCH', help='The branch you want to work
 p.add('--git_hostname', env_var='GIT_HOSTNAME', default='git@gitlab.opencode.de', help='Set the hostname for the chart git checkouts.')
 p.add('--revert', default=False, action='store_true', help='Set this parameter if you want to revert the referencing of the local helm chart checkout paths in the helmfiles.')
 p.add('--match', default='', help="Clone/pull only charts that contain the given string in their name.")
-p.add('--pull', default=False, action='store_true', help='Will also pull and unpack Helm charts that are not developed by product development.')
 p.add('--loglevel', env_var='LOGLEVEL', default='DEBUG', help='Set the loglevel: DEBUG, INFO, WARNING, ERROR, CRITICAL-')
 options = p.parse_args()
 
@@ -78,13 +77,10 @@ def create_path_if_not_exists(path):
         Path(path).mkdir(parents=True, exist_ok=True)
 
 def clone_charts_locally(branch, charts):
-    charts_clone_path = script_path+'/../../chart-repo/'+branch.replace('/', '_')
-    charts_pull_path = script_path+'/../../chart-pull/'+branch.replace('/', '_')
+    charts_path = script_path+'/../../charts-'+branch.replace('/', '_')
     charts_dict = {}
     doublette_dict = {}
-    create_path_if_not_exists(charts_clone_path)
-    if options.pull:
-        create_path_if_not_exists(charts_pull_path)
+    create_path_if_not_exists(charts_path)
 
     for chart in charts['charts']:
         tag = charts['charts'][chart]['version']
@@ -92,41 +88,43 @@ def clone_charts_locally(branch, charts):
         registry = charts['charts'][chart]['registry']
         name = charts['charts'][chart]['name']
         logging.debug(f"Working on {chart} / tag {tag} / repo {repository}")
+        chart_local_path = charts_path+'/'+name
         if not options.match in name:
             logging.info(f"Chart name {name} does not match {options.match} - skipping...")
+            continue
         elif registry == '':
             logging.info("Empty registry definition - skipping...")
+            continue
+        if os.path.isdir(chart_local_path):
+            logging.debug(f"Found pre-existing {chart_local_path} skipping clone/pull, but will still reference chart in Helmfile...")
+            charts_dict[chart] = chart_local_path
+            git_url = options.git_hostname+':'+repository
+            doublette_dict[git_url] = chart_local_path
+            continue
         elif 'opendesk/components/platform-development/charts' in repository:
             logging.info("Cloning the charts repo")
             git_url = options.git_hostname+':'+repository
-            chart_repo_path = charts_clone_path+'/'+charts['charts'][chart]['name']
             if git_url in doublette_dict:
                 logging.debug(f"{chart} located at {git_url} is already checked out to {doublette_dict[git_url]}")
                 charts_dict[chart] = doublette_dict[git_url]
             else:
-                if os.path.isdir(chart_repo_path):
-                    logging.debug(f"Already exists {chart_repo_path} leaving it unmodified")
-                else:
-                    logging.debug(f"Cloning into {chart_repo_path}")
-                    Repo.clone_from(git_url, chart_repo_path)
-                    chart_repo = Repo(path=chart_repo_path)
-                    chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
-                doublette_dict[git_url] = chart_repo_path
-                charts_dict[chart] = chart_repo_path
-        elif options.pull:
+                logging.debug(f"Cloning into {chart_local_path}")
+                Repo.clone_from(git_url, chart_local_path)
+                chart_repo = Repo(path=chart_local_path)
+                chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
+                doublette_dict[git_url] = chart_local_path
+                charts_dict[chart] = chart_local_path
+        else:
             logging.info("Pulling the chart")
-            helm_command = f"helm pull oci://{registry}/{repository}/{name} --version {tag} --untar --destination {charts_pull_path}"
+            helm_command = f"helm pull oci://{registry}/{repository}/{name} --version {tag} --untar --destination {charts_path}"
             logging.debug(f"CLI command: {helm_command}")
             try:
-                output = subprocess.check_output(helm_command, shell = True)
+                subprocess.check_output(helm_command, shell = True)
             except subprocess.CalledProcessError:
                 sys.exit(f"! CLI command '{helm_command}' failed")
-        else:
-            logging.debug("Not a product development chart and `--pull` option not enabled - skipping...")
-
+            charts_dict[chart] = chart_local_path
     return charts_dict
 
-
 def grep_yaml(file):
     with open(file, 'r') as file:
         content = ''
@@ -156,7 +154,12 @@ def process_the_helmfiles(charts_dict, charts):
                     for chart_ident in charts_dict:
                         if '.Values.charts.'+chart_ident+'.name' in line:
                             logging.debug(f"found match with {chart_ident} in {line.strip()}")
-                            line = chart_def_prefix+charts_dict[chart_ident]+'/charts/'+charts['charts'][chart_ident]['name']+'" # replaced by local-dev script'+"\n"
+                            line = charts_dict[chart_ident]
+                            if os.path.isdir(line+'/charts/'+charts['charts'][chart_ident]['name']):
+                                line += '/charts/'+charts['charts'][chart_ident]['name']
+                            elif not os.path.isdir(line):
+                                sys.exit(f"! Did not find directory to reference in Helmfile: '{line}'")
+                            line = chart_def_prefix+line+'" # replaced by local-dev script'+"\n"
                             child_helmfile_updated = True
                             break
                 output.append(line)

docs/architecture.md

@@ -44,7 +44,7 @@ openDesk is designed as a [Kubernetes](https://kubernetes.io) deployment.
 
 It consists of a set of [Helm charts](https://helm.sh/) orchestrated by [Helmfile](https://github.com/helmfile/helmfile).
 
-openDesk includes the functional applications, like file management, chat, and email. Other services such
+openDesk includes functional applications, like file management, chat, and email. Other services such
 as databases and object storage are included for evaluation purposes only. In production, you must provide
 these services yourself.
 
@@ -73,12 +73,12 @@ flowchart TD
 openDesk includes a portal that allows navigation to the respective application. The portal is part of the
 Identity and Access Management (IAM) application shipped with openDesk: *Nubus*. Nubus includes OpenLDAP
 for storing users, groups, and permissions, and Keycloak for single sign-on with LDAP user federation
-configured to the aforementioned OpenLDAP.
+configured to use the aforementioned OpenLDAP.
 
 When the user is authenticated by Keycloak, the portal shows the applications the user is permitted to access.
 
-The user can now access applications and use the corresponding functionality without the need to authenticate to
-applications again. This is implemented using the OpenID Connect (OIDC) protocol.
+The user can now access applications and use the corresponding functionality without the need to authenticate 
+again. This is implemented using the OpenID Connect (OIDC) protocol.
 
 # Nubus (IAM)
 
@@ -111,11 +111,11 @@ In openDesk, Nubus serves the following purposes:
 
 6. Frontend Integration Authentication
 
-    A specialized component - the Intercom Service - acts according to the Backend-for-Frontend pattern when it comes to certain integration use cases requiring the frontend of one application to call the API of another service that also has the need for user authentication. See [Component integration](#component-integration) for more details.
+    A specialized component - the Intercom Service - acts according to the Backend-for-Frontend pattern when it comes to certain integration use cases, for example, ones that require the frontend of one application to call the API of another service, that also has the need for user authentication. See [Component integration](#component-integration) for more details.
 
 7. Portal
 
-   Nubus provides a Portal component for users to access the connected applications, that also includes a self service e.g. for password reset.
+   Nubus provides a Portal component for users to access the connected applications. This component also includes self-service possibilities  e.g. for password resetting.
 
 For additional information, refer to the [Nubus for Kubernetes Architecture Manual](https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/index.html).
 
@@ -197,16 +197,16 @@ For more information, see the [Keycloak Documentation](https://www.keycloak.org/
 
 ## Keycloak Extensions
 
-Part of Nubus are the [Keycloak Extensions](https://docs.software-univention.de/nubus-kubernetes-operation/1.0/en/configuration/keycloak-extensions.html) used for
+Part of Nubus are the [Keycloak Extensions](https://docs.software-univention.de/nubus-kubernetes-operation/1.0/en/configuration/keycloak-extensions.html) which are used for:
 
-- Login brute force protection: Blocking authentication requests upon too much failed attempts from a device or IP. The available [CAPTCHA](https://en.wikipedia.org/wiki/CAPTCHA) option is deactivated in openDesk.
-- New device notification: Sending the use an email after successful login from a new device.
+- Login brute force protection: Blocking authentication requests upon too many failed attempts from a device or IP. _The available [CAPTCHA](https://en.wikipedia.org/wiki/CAPTCHA) option is deactivated in openDesk._
+- New device notification: Sending the user an email after successful login from a new device.
 
-To address these use cases the Keycloak Extensions act as a proxy to Keycloak.
+To address these use cases, the Keycloak Extensions act as a proxy to Keycloak.
 
 ## OpenLDAP
 
-[OpenLDAP](https://www.openldap.org) is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a central repository for user and group information. In openDesk, OpenLDAP is used as the user directory to store user and group data and manage access control policies across the applications.
+[OpenLDAP](https://www.openldap.org) is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a central repository for user and group information. In openDesk, OpenLDAP is used as the user directory to store user and group data, and also manages access control policies across the applications.
 
 # Authorization
 
@@ -214,21 +214,21 @@ To address these use cases the Keycloak Extensions act as a proxy to Keycloak.
 
 LDAP group synchronization ensures that user group memberships are consistent across the applications in openDesk that make use of the IAM group information. Nubus uses OpenLDAP to store and manage user groups, which are synchronized with integrated applications to enforce access control policies.
 
-Beside Keycloak LDAP groups are available to the following applications, none of the application supports nested groups. It means that users must be direct members of a group, as members of sub groups are ignored.
-- Files / Nextcloud: Reads all groups that are enabled for Nextcloud twice a day based on the setting `background_sync_interval` in the `user_ldap` app.
-- Knowledge Management / XWiki: Reads all groups that are enabled for XWiki use, this is done nightly based the jobs `LDAP Group Import Job` and `Mapped groups daily updater` that admin users can access in `/bin/view/Scheduler`.
-- Project Management / OpenProject: Reads all groups that are enabled for OpenProject [hourly](https://www.openproject.org/docs/system-admin-guide/authentication/ldap-connections/ldap-group-synchronization/#create-a-synchronized-group).
-- Webmail / OX AppSuite: Requires a webmail user to be part of a group before the group is actively provisioned to OX AppSuite.
+Keycloak LDAP groups are available to the following applications, however, none of the applications support nested groups. This means that users must be direct members of a group, as members of subgroups will be ignored.
+- Files / Nextcloud: Reads all groups that are enabled for Nextcloud, twice a day. Determined by the setting `background_sync_interval` in the `user_ldap` app.
+- Knowledge Management / XWiki: Reads all groups that are enabled for XWiki use, once daily during the night. Based on the jobs `LDAP Group Import Job` and `Mapped groups daily updater` that are accessible to admin users in `/bin/view/Scheduler`.
+- Project Management / OpenProject: Reads all groups that are enabled for OpenProject, [hourly](https://www.openproject.org/docs/system-admin-guide/authentication/ldap-connections/ldap-group-synchronization/#create-a-synchronized-group).
+- Webmail / OX AppSuite: Requires a webmail user to be a part of a group before the group is actively provisioned to OX AppSuite.
 
 # Provisioning
 
 Part of the already mentioned Nubus IAM is a [provisioning service](https://docs.software-univention.de/nubus-kubernetes-architecture/0.5/en/components/provisioning-service.html).
 
-Beside the Nubus internal user of the provisioning service the OX AppSuite is currently the only openDesk application that is getting data actively provisioned in contrast to scenarios where applications fetch the required information from the LDAP.
+Besides the Nubus internal user of the provisioning service, the OX AppSuite is currently the only openDesk application that is getting data actively provisioned to it. This is in contrast to the norm, where applications fetch the required information from the LDAP themselves.
 
 ## OX Connector
 
-As the OX AppSuite is using an application specific format to get e.g. users provisioned, there is also a specific connector component that links to provisioning service to the OX AppSuite, it is called the [OX Connector](https://docs.software-univention.de/manual/5.0/de/mail/ox-connector.html).
+As the OX AppSuite is using an application specific format to get e.g. users provisioned, there is also a specific connector component that links the provisioning service to the OX AppSuite, it is called the [OX Connector](https://docs.software-univention.de/manual/5.0/de/mail/ox-connector.html).
 
 The [OX SOAP API](https://oxpedia.org/wiki/index.php?title=Open-Xchange_Provisioning_using_SOAP) is used by the OX Connector to synchronize information about the follow OX AppSuite objects:
 - Contexts
@@ -237,20 +237,20 @@ The [OX SOAP API](https://oxpedia.org/wiki/index.php?title=Open-Xchange_Provisio
 - (Managed) Resources
 - Users
 
-To find out more, see [Roles & Permissions](permissions.md).
+To find out more, see [Roles & Permissions](./docs/permissions.md).
 
 ## SCIM
 
 [System for Cross-domain Identity Management](https://scim.cloud) (SCIM) is an open standard for automating the exchange of user identity information between identity domains or IT systems. SCIM is designed to make user provisioning and management easier by providing a standardized way to manage user identities in cloud-based applications and services.
 
-In openDesk, SCIM will be used in the future to automate the process of creating, updating, and deactivating user accounts across the applications. This ensures that user data is consistent and up-to-date across all applications, reducing the administrative overhead and potential for errors.
+In openDesk, SCIM will be used in the future to automate the process of creating, updating, and deactivating user accounts across the applications. This ensures that user data is consistent across all applications, reducing the administrative overhead and potential for errors.
 
 > **Note:**<br>
 > SCIM support is planned in openDesk for 2025.
 
 # Component integration
 
-Important, especially from the end user perspective are the functional integrations between the different openDesk applications.
+Important, especially from the end user perspective, are the functional integrations between the different openDesk applications.
 
 ```mermaid
 flowchart TD
@@ -276,19 +276,19 @@ Details can be found in the upstream documentation that is linked in the respect
 ## Intercom Service / Silent Login
 
 The Intercom Service is deployed in the context of Nubus. Its role is to enable cross-application integration
-based on the user's browser interaction as handling authentication when the frontend of an application has to call
-the API from another application is often a challenge.
+based on the user's browser interaction, as handling authentication when the frontend of an application has to call
+the API from another application is often challenging.
 
 To establish a session with the Intercom Service, applications can use the silent login feature within an iframe.
 
 Currently, only OX AppSuite and Element are using the frontend-based integration.
 
-**Links**
+**Links:**
 - [Intercom Service upstream documentation](https://docs.software-univention.de/intercom-service/latest/index.html).
 
 ## Central Contacts
 
-OX App Suite is managing contacts in openDesk. Therefore, Nextcloud's PHP backend is using the OX AppSuite's middleware Contacts API to
+OX App Suite is responsible for managing contacts in openDesk. Therefore, Nextcloud's PHP backend is using the OX AppSuite's middleware Contacts API to
 - create a new contact in the user's contacts folder when a file is shared with an unknown email address.
 - retrieve contacts from the user's contacts folder to support search-as-you-type when starting to share a file.
 
@@ -302,7 +302,7 @@ Central navigation is based on an API endpoint in the Nubus portal that returns
 a given user. The response from the API endpoint is used in the openDesk applications to render the central navigation.
 
 The API can be called by
-- frontend services through the Intercom Service's `/navigation.json` endpoint or
+- frontend services through the Intercom Service's `/navigation.json` endpoint.
 - backend services directly at the portal's `/univention/portal/navigation.json` endpoint.
 
 The central navigation expects the API caller to present a shared secret for authentication and the username for whom the portal
@@ -316,7 +316,7 @@ curl 'https://portal.<DOMAIN>/univention/portal/navigation.json?base=https%3A//p
 
 ## Filepicker
 
-The Nextcloud Filepicker is integrated into the OX AppSuite, supporting the following use cases against the respective openDesk instance's Nextcloud:
+The Nextcloud Filepicker is integrated into the OX AppSuite, supporting the following use cases within the respective openDesk instance's Nextcloud:
 - Attach files from Nextcloud to emails.
 - Create and add links to Nextcloud files into emails.
 - Save attachments from emails into Nextcloud.
@@ -324,10 +324,10 @@ The Nextcloud Filepicker is integrated into the OX AppSuite, supporting the foll
 
 The Filepicker uses frontend and backend-based integration:
 - For frontend-based integration, the OX AppSuite frontend uses the Intercom Service.
-- Backend-based integration is coming from OX AppSuite middleware. The middleware communicates directly with Nextcloud
-when adding a file to an email or storing a file into Nextcloud to avoid passing these files through the user's browser.
+- Backend-based integration is coming from the OX AppSuite middleware. The middleware communicates directly with Nextcloud
+when attaching a file to an email or storing a file in Nextcloud to avoid passing these files through the user's browser.
 
-**Links**
+**Links:**
 - [OX AppSuite Nextcloud Integration upstream documentation](https://gitlab.open-xchange.com/extensions/nextcloud-integration/-/tree/main/documentation).
 
 ## Newsfeed
@@ -381,7 +381,7 @@ The end user focussed components are called applications and provide the functio
 
 Other components are of type "Service", these are used for development and evaluation purposes only, they need to be replaced in production deployments.
 
-For the APIs / Protocols supported by the applications, please read the [apis.md](./architecture/apis.md).
+For the APIs / Protocols supported by the applications, please read the [apis.md](./docs/architecture/apis.md).
 
 ## Collabora (Office)
 
@@ -391,7 +391,7 @@ In openDesk, Collabora is used for editing Office documents such as rich texts,
 
 ## CryptPad Online (Diagrams)
 
-[CryptPad](https://cryptpad.org/) is a collaborative editor framework supporting end-to-end encryption..
+[CryptPad](https://cryptpad.org/) is a collaborative editor framework supporting end-to-end encryption.
 
 In openDesk, CryptPad is for editing diagrams.net documents.
 
@@ -407,6 +407,8 @@ In openDesk, Element is used for chat and direct audio & video calling.
 
 In openDesk, Jitsi is used for video conferencing and online meetings. It integrates with other applications to provide seamless communication capabilities.
 
+[Jigasi](https://github.com/jitsi/jigasi) (Jitsi's SIP component) also allows joining the meeting via phone call if an external SIP server and SIP trunk are provided.
+
 ## Nextcloud (Files)
 
 [Nextcloud](https://nextcloud.com) is a file storage and sync platform with powerful collaboration capabilities with desktop, mobile and web interfaces.
@@ -415,7 +417,7 @@ In openDesk, Jitsi is used for video conferencing and online meetings. It integr
 
 [Nubus](https://www.univention.com/products/nubus/) is a unified Identity & Access Management, providing you with full control and digital sovereignty over your IAM processes and data.
 
-In openDesk Nubus is providing the management for user, groups and other IAM stored objects, as well as the portal, the Identity provider for Single Sign-On and federation scenarios and the
+In openDesk, Nubus provides the management required for users, groups and other IAM objects, as well as the portal, the Identity provider for Single Sign-On and federation scenarios.
 
 ## OpenProject (Project management)
 
@@ -433,7 +435,7 @@ In openDesk, OX App Suite is used for email, calendar, address book and personal
 
 # Application specific user accounts
 
-While the IAM managed users centrally, some applications come with local accounts for administrative purposes.
+While the IAM manages users centrally, some applications come with local accounts for administrative purposes:
 
 | Application  | Account name                                  | Purpose                                                                                                                 | Password                                         |
 | ------------ | --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ |

docs/architecture/apis.md

@@ -5,8 +5,9 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>openDesk APIs</h1>
 
-This chapter presents APIs available in openDesk grouped by applications.
+This chapter presents APIs available in openDesk, grouped by application.
 
+<!-- TOC -->
 * [IAM - Nubus](#iam---nubus)
   * [UMC Python API](#umc-python-api)
   * [UMC store API](#umc-store-api)
@@ -43,7 +44,7 @@ This chapter presents APIs available in openDesk grouped by applications.
   * [BCF API](#bcf-api)
 * [Video Conferencing - Jitsi](#video-conferencing---jitsi)
   * [IFrame API](#iframe-api)
-  * [Lib-jitsi-meet API](#lib-jitsi-meet-api)
+  * [lib-jitsi-meet API](#lib-jitsi-meet-api)
   * [Jitsi Meet React SDK](#jitsi-meet-react-sdk)
 * [Chat - Element](#chat---element)
   * [Matrix Application Service API](#matrix-application-service-api)
@@ -60,6 +61,7 @@ This chapter presents APIs available in openDesk grouped by applications.
   * [Scripting API](#scripting-api)
   * [Java API](#java-api)
   * [JavaScript API](#javascript-api)
+<!-- TOC -->
 
 # IAM - Nubus
 
@@ -86,19 +88,19 @@ This chapter presents APIs available in openDesk grouped by applications.
 
 ## UMC store API
 
-| Name                           | UMC store API (also named UMC JavaScript API or Dojo/UMC JavaScript API)                                  |
-| ------------------------------ | --------------------------------------------------------------------------------------------------------- |
-| Purpose                        | Encapsulate and ease the access to module data from JavaScript                                            |
-| Versioning                     |                                                                                                           |
-| Authentication                 |                                                                                                           |
-| In openDesk provided by        | Nubus UMC                                                                                                 |
-| Transport protocol             |                                                                                                           |
-| Usage within component         |                                                                                                           |
-| Usage within openDesk          |                                                                                                           |
-| Usage for external integration |                                                                                                           |
-| Parallel access                | Allowed                                                                                                   |
-| Message protocol               |                                                                                                           |
-| Supported standards            |                                                                                                           |
+| Name                           | UMC store API (also named UMC JavaScript API or Dojo/UMC JavaScript API)                                 |
+| ------------------------------ |----------------------------------------------------------------------------------------------------------|
+| Purpose                        | Encapsulate and ease the access to JavaScript module data                                                |
+| Versioning                     |                                                                                                          |
+| Authentication                 |                                                                                                          |
+| In openDesk provided by        | Nubus UMC                                                                                                |
+| Transport protocol             |                                                                                                          |
+| Usage within component         |                                                                                                          |
+| Usage within openDesk          |                                                                                                          |
+| Usage for external integration |                                                                                                          |
+| Parallel access                | Allowed                                                                                                  |
+| Message protocol               |                                                                                                          |
+| Supported standards            |                                                                                                          |
 | Documentation                  | https://docs.software-univention.de/developer-reference/5.0/en/umc/local-system-module.html#umc-store-api |
 
 ## IntercomService (ICS) API
@@ -111,7 +113,7 @@ This chapter presents APIs available in openDesk grouped by applications.
 | In openDesk provided by        | Nubus UMC                                                                                                                                                                                                                           |
 | Transport protocol             | HTTP(S)                                                                                                                                                                                                                             |
 | Usage within component         |                                                                                                                                                                                                                                     |
-| Usage within openDesk          | The ICS implements the BFF pattern for various openDesk inter-component integrations, see also [components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/components.md#component-integration) |
+| Usage within openDesk          | The ICS implements the BFF pattern for various openDesk inter-component integrations, see [components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/components.md#component-integration) |
 | Usage for external integration |                                                                                                                                                                                                                                     |
 | Parallel access                | Allowed                                                                                                                                                                                                                             |
 | Message protocol               | Depends on the integration use case.                                                                                                                                                                                                |
@@ -127,7 +129,7 @@ This chapter presents APIs available in openDesk grouped by applications.
 | Authentication                 |                                                                                                                                                                                                                                     |
 | In openDesk provided by        | Univention Event Processing                                                                                                                                                                                                         |
 | Transport protocol             |                                                                                                                                                                                                                                     |
-| Usage within component         | The listener mechanism is used to dispatch events from the LDAP to the Nubus provisioning service. It should be replaced by another approach in the future.                                                                          |
+| Usage within component         | The listener mechanism is used to dispatch events from the LDAP to the Nubus provisioning service. It should be replaced with another approach in the future.                                                                       |
 | Usage within openDesk          | The ICS implements the BFF pattern for various openDesk inter-component integrations, see also [components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/components.md#component-integration) |
 | Usage for external integration |                                                                                                                                                                                                                                     |
 | Parallel access                | Allowed                                                                                                                                                                                                                             |
@@ -142,8 +144,8 @@ More details on the Nubus provisioning service can be found here: https://docs.s
 ![Composition of UMC component with APIs highlighted](./apis_images/IAM-udm.png)
 
 | Name                           | UDM Simple API                                                    |
-| ------------------------------ | ----------------------------------------------------------------- |
-| Purpose                        | Allows to use capability and objects directly in Python programs. |
+| ------------------------------ |-------------------------------------------------------------------|
+| Purpose                        | Allows use of capability and objects directly in Python programs. |
 | Versioning                     |                                                                   |
 | Authentication                 |                                                                   |
 | In openDesk provided by        | Univention Directory Manager                                      |
@@ -165,7 +167,7 @@ More details on the Nubus provisioning service can be found here: https://docs.s
 | Authentication                 | Basic Auth                                                                                                                                 |
 | In openDesk provided by        | Univention Directory Manager                                                                                                               |
 | Transport protocol             | HTTP(S)                                                                                                                                    |
-| Usage within component         | The Nubus bootstrapping makes use of the API.                                                                                               |
+| Usage within component         | The Nubus bootstrapping process makes use of the API.                                                                                      |
 | Usage within openDesk          |                                                                                                                                            |
 | Usage for external integration | The [openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import) utilizes the API. |
 | Parallel access                | Allowed                                                                                                                                    |
@@ -184,7 +186,7 @@ More details on the Nubus provisioning service can be found here: https://docs.s
 | Authentication                 |                                                                                                     |
 | In openDesk provided by        | Nubus                                                                                               |
 | Transport protocol             |                                                                                                     |
-| Usage within component         | The Nubus bootstrapping makes use of the API.                                                       |
+| Usage within component         | The Nubus bootstrapping process makes use of the API.                                               |
 | Usage within openDesk          |                                                                                                     |
 | Usage for external integration |                                                                                                     |
 | Parallel access                | Allowed                                                                                             |
@@ -194,20 +196,20 @@ More details on the Nubus provisioning service can be found here: https://docs.s
 
 ## LDAP
 
-| Name                           | LDAP                                                                                                                   |
-| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------- |
-| Purpose                        | Read access to Nubus LDAP                                                                                              |
-| Versioning                     | n/a                                                                                                                    |
-| Authentication                 | LDAP user auth                                                                                                         |
-| In openDesk provided by        | Nubus openLDAP                                                                                                         |
-| Transport protocol             | LDAP                                                                                                                   |
-| Usage within component         | Data backend for Nubus                                                                                                 |
-| Usage within openDesk          | Used by multiple application to access user/group data, e.g. Nextcloud Server, OpenProject, OX AppSuite backend, XWiki |
-| Usage for external integration | No recommended                                                                                                         |
-| Parallel access                | Allowed                                                                                                                |
-| Message protocol               | LDAP                                                                                                                   |
-| Supported standards            | LDAP                                                                                                                   |
-| Documentation                  | https://docs.software-univention.de/manual/5.0/en/domain-ldap/ldap-directory.html                                      |
+| Name                           | LDAP                                                                                                                    |
+| ------------------------------ |-------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Read access to Nubus LDAP                                                                                               |
+| Versioning                     | n/a                                                                                                                     |
+| Authentication                 | LDAP user auth                                                                                                          |
+| In openDesk provided by        | Nubus openLDAP                                                                                                          |
+| Transport protocol             | LDAP                                                                                                                    |
+| Usage within component         | Data backend for Nubus                                                                                                  |
+| Usage within openDesk          | Used by multiple applications to access user/group data, e.g. Nextcloud Server, OpenProject, OX AppSuite backend, XWiki |
+| Usage for external integration | Not recommended                                                                                                         |
+| Parallel access                | Allowed                                                                                                                 |
+| Message protocol               | LDAP                                                                                                                    |
+| Supported standards            | LDAP                                                                                                                    |
+| Documentation                  | https://docs.software-univention.de/manual/5.0/en/domain-ldap/ldap-directory.html                                       |
 
 ## Nubus Provisioning Service (**TBD**)
 
@@ -219,24 +221,24 @@ To be delivered.
 
 # Groupware - OX AppSuite / OX Dovecot
 
-![OX AppSuite APIs overview](./apis_images/Groupware-apis.png)
+![OX AppSuite APIs overview](./apis_images/Groupware-api.png)
 
 ![Use of OX AppSuite APIs by other components](./apis_images/Groupware-api-usage.png)
 
 ## Usage of APIs within openDesk
 
-Following are APIs used by the Groupware application:
+The following are the APIs used by the Groupware application:
 
 | Used by                        | Accessed component | Service            | Purpose                                                     | Message format                   |
 | ------------------------------ | ------------------ | ------------------ | ----------------------------------------------------------- | -------------------------------- |
 | AppSuite Middleware            | Keycloak           | Authentication     | Single sign-on / sign-out                                   | OIDC                             |
 | Dovecot                        | Keycloak           | Authentication     | Authenticate user                                           | OIDC                             |
-| AppSuite Frontend (in Browser) | Intercom Service   | Silent Login       | Stablish Intercom Service session                           |                                  |
+| AppSuite Frontend (in Browser) | Intercom Service   | Silent Login       | Establish Intercom Service session                          |                                  |
 | AppSuite Frontend (in Browser) | Intercom Service   | Central Navigation | Retrieve content for openDesk Navigation drop-down          | JSON                             |
 | AppSuite Frontend (in Browser) | Intercom Service   | Element Bot        | Manage (CUD) meetings in Element                            | Custom JSON (based on iCalender) |
 | AppSuite Frontend (in Browser) | Intercom Service   | Filepicker         | Read/write contents from/to Nextcloud or create share links | WebDAV & Nextcloud API           |
 | AppSuite Middleware            | Nextcloud          | Filepicker         | Read/write files from/to Nextcloud                          | WebDAV & Nextcloud API           |
-| AppSuite Middleware            | Element Bot        | Element Bot        | Update/delete meetings in Element                            | Custom JSON (based on iCalender) |
+| AppSuite Middleware            | Element Bot        | Element Bot        | Update/delete meetings in Element                           | Custom JSON (based on iCalender) |
 | AppSuite Middleware            | LDAP               | Address book       | Search for global contacts and retrieve contact details     | LDAP                             |
 | Dovecot                        | LDAP               | Data retrieval     | Retrieve necessary user details to handle mailboxes         | LDAP                             |
 
@@ -247,13 +249,13 @@ Following are APIs used by the Groupware application:
 | Name                           | HTTP API                                                                                                                                                                                                     |
 | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Purpose                        | Login, accessing email, contacts, calendar, tasks, configs, email filtering, task automation, workflow automation, etc – most of the AppSuite's functionality that is available to the user through the Web-UI. |
-| Versioning                     | No API-specific versioning. The version can be considered identical with OX App Suite version, which is contained in URL of online documentation of API.                                                        |
+| Versioning                     | No API-specific versioning. The version can be considered identical to the OX App Suite version, which is contained in the URL of the online API documentation.                                                 |
 | Authentication                 |                                                                                                                                                                                                                 |
 | In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                                                          |
 | Transport protocol             | HTTP(S)                                                                                                                                                                                                         |
 | Usage within component         | Used by OX Web-UI (Frontend)                                                                                                                                                                                    |
-| Usage within openDesk          | - Nextcloud used the SearchAPI to synchronize contacts<br>- Nordeck Meeting bot synchronizes OX meeting changes applied in Element.                                                                             |
-| Usage for external integration | Not used at the moment, but recommended way to integrate with OX AppSuite.                                                                                                                                      |
+| Usage within openDesk          | - Nextcloud uses the SearchAPI to synchronize contacts<br>- Nordeck Meeting bot synchronizes OX meeting changes applied in Element.                                                                             |
+| Usage for external integration | Not used at the moment, but is the recommended way to integrate with OX AppSuite.                                                                                                                               |
 | Parallel access                | Allowed                                                                                                                                                                                                         |
 | Message protocol               | JSON based, AppSuite specific format                                                                                                                                                                            |
 | Supported standards            | iCal, defined by RFC, fully implemented                                                                                                                                                                         |
@@ -281,26 +283,26 @@ Following are APIs used by the Groupware application:
 
 ## REST API
 
-| Name                           | REST API                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Purpose                        | Delivers services in following functional groups:<br>- *Admin*: Interface for provisioning and other administrative operations<br>- *Advertisement*: The advertisement module<br>- *Health*: The health-check module<br>- *InternetFreeBusy*: Servlet for requesting free busy data<br>- *Metrics*: The metrics module<br>- *Preliminary*: This module contains preliminary endpoints which can change in the future<br>- *Push*: The push module<br>- *Userfeedback*: The user feedback module |
-| Versioning                     | No API-specific versioning. The version can be considered identical with OX App Suite version, which is contained in URL of online documentation of API.                                                                                                                                                                                                                                                                                                                                        |
-| Authentication                 | Basic Auth                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| Transport protocol             | HTTP(S)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| Usage within component         | Push module is used by OX Frontend.                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| Usage within openDesk          | none                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| Usage for external integration | none                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| Parallel access                | Allowed                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| Message protocol               | - Email Body RFC 822 is used by Push<br>- Prometheus format is used by Metrics API<br>- API iCal format is used by InternetFreeBusy                                                                                                                                                                                                                                                                                                                                                             |
-| Supported standards            | SOAP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| Documentation                  | https://documentation.open-xchange.com/components/middleware/rest/8/index.html                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| Name                           | REST API                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| ------------------------------ |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Delivers services in the following functional groups:<br>- *Admin*: Interface for provisioning and other administrative operations<br>- *Advertisement*: The advertisement module<br>- *Health*: The health-check module<br>- *InternetFreeBusy*: Servlet for requesting free busy data<br>- *Metrics*: The metrics module<br>- *Preliminary*: This module contains preliminary endpoints which may change in the future<br>- *Push*: The push module<br>- *Userfeedback*: The user feedback module |
+| Versioning                     | No API-specific versioning. The version can be considered identical to the OX App Suite version, which is contained in the URL of the online API documentation.                                                                                                                                                                                                                                                                                                                                     |
+| Authentication                 | Basic Auth                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Usage within component         | Push module is used by OX Frontend.                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| Usage within openDesk          | none                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| Usage for external integration | none                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| Parallel access                | Allowed                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Message protocol               | - Email Body RFC 822 is used by Push<br>- Prometheus format is used by Metrics API<br>- API iCal format is used by InternetFreeBusy                                                                                                                                                                                                                                                                                                                                                                 |
+| Supported standards            | SOAP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| Documentation                  | https://documentation.open-xchange.com/components/middleware/rest/8/index.html                                                                                                                                                                                                                                                                                                                                                                                                                      |
 ## CardDAV
 
 | Name                           | CardDAV                                                                                                                                                                 |
 | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Purpose                        | Designed for rich clients. Synchronization of contact entries in both directions (i.e. as a server and as a client); vCard import and export are available via OX HTTP API |
-| Versioning                     | Yes, API version is specific to the version of underlying protocol                                                                                                         |
+| Versioning                     | Yes, API version is specific to the version of the underlying protocol                                                                                                     |
 | Authentication                 |                                                                                                                                                                            |
 | In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                     |
 | Transport protocol             | HTTP(S)                                                                                                                                                                    |
@@ -317,7 +319,7 @@ Following are APIs used by the Groupware application:
 | Name                           | CalDAV                                                                                                                                                                  |
 | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Purpose                        | Designed for rich clients. Synchronization of contact entries in both directions (i.e. as a server and as a client); vCard import and export are available via OX HTTP API |
-| Versioning                     | Yes, API version is specific to the version of underlying protocol                                                                                                         |
+| Versioning                     | Yes, API version is specific to the version of the underlying protocol                                                                                                     |
 | Authentication                 |                                                                                                                                                                            |
 | In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                     |
 | Transport protocol             | HTTP(S)                                                                                                                                                                    |
@@ -331,37 +333,37 @@ Following are APIs used by the Groupware application:
 
 ## IMAP
 
-| Name                           | IMAP                                                               |
-| ------------------------------ | ------------------------------------------------------------------ |
-| Purpose                        | Used for retrieval of emails, designed for rich clients            |
-| Versioning                     | Yes, API version is specific to the version of underlying protocol |
-| Authentication                 |                                                                    |
-| In openDesk provided by        | OX Dovecot                                                         |
-| Transport protocol             | TCP                                                                |
-| Usage within component         | Used by OX AppSuite middleware to read/write mail and folders      |
-| Usage within openDesk          | none                                                               |
-| Usage for external integration | Can be used by local IMAP clients (e.g. Thunderbird)               |
-| Parallel access                | Allowed                                                            |
-| Message protocol               | RFC 9051                                                           |
-| Supported standards            | IMAP                                                               |
-| Documentation                  | https://www.rfc-editor.org/rfc/rfc9051                             |
+| Name                           | IMAP                                                                                 |
+| ------------------------------ |--------------------------------------------------------------------------------------|
+| Purpose                        | Used for retrieval of emails, designed for rich clients                              |
+| Versioning                     | Yes, API version is specific to the version of the underlying protocol               |
+| Authentication                 |                                                                                      |
+| In openDesk provided by        | OX Dovecot                                                                           |
+| Transport protocol             | TCP                                                                                  |
+| Usage within component         | Used by OX AppSuite middleware to read/write mail and folders                        |
+| Usage within openDesk          | none                                                                                 |
+| Usage for external integration | Can be used by local IMAP clients (e.g. Thunderbird)                                 |
+| Parallel access                | Allowed                                                                              |
+| Message protocol               | RFC 9051                                                                             |
+| Supported standards            | IMAP                                                                                 |
+| Documentation                  | https://www.rfc-editor.org/rfc/rfc9051                                               |
 
 ## POP3
 
-| Name                           | POP3                                                               |
-| ------------------------------ | ------------------------------------------------------------------ |
-| Purpose                        | Used for retrieval of emails, designed for rich clients            |
-| Versioning                     | Yes, API version is specific to the version of underlying protocol |
-| Authentication                 |                                                                    |
-| In openDesk provided by        | OX Dovecot                                                         |
-| Transport protocol             | TCP                                                                |
-| Usage within component         | none                                                               |
-| Usage within openDesk          | none                                                               |
-| Usage for external integration | Can be used by local POP3 clients (e.g. Thunderbird)               |
-| Parallel access                | Allowed                                                            |
-| Message protocol               | RFC 1939                                                           |
-| Supported standards            | IMAP                                                               |
-| Documentation                  | https://www.rfc-editor.org/rfc/rfc1939                             |
+| Name                           | POP3                                                                   |
+| ------------------------------ |------------------------------------------------------------------------|
+| Purpose                        | Used for retrieval of emails, designed for rich clients                |
+| Versioning                     | Yes, API version is specific to the version of the underlying protocol |
+| Authentication                 |                                                                        |
+| In openDesk provided by        | OX Dovecot                                                             |
+| Transport protocol             | TCP                                                                    |
+| Usage within component         | none                                                                   |
+| Usage within openDesk          | none                                                                   |
+| Usage for external integration | Can be used by local POP3 clients (e.g. Thunderbird)                   |
+| Parallel access                | Allowed                                                                |
+| Message protocol               | RFC 1939                                                               |
+| Supported standards            | IMAP                                                                   |
+| Documentation                  | https://www.rfc-editor.org/rfc/rfc1939                                 |
 
 # Files - Nextcloud
 
@@ -369,7 +371,7 @@ Following are APIs used by the Groupware application:
 
 ## Usage of APIs within openDesk
 
-Following are APIs used by the Files application:
+The following are the APIs used by the Files application:
 
 | Used by          | Accessed component     | Service                | Purpose                                            | Message format |
 | ---------------- | ---------------------- | ---------------------- | -------------------------------------------------- | -------------- |
@@ -383,12 +385,12 @@ Following are APIs used by the Files application:
 | Name                           | OCS API                                                                                                                                                                                                                                |
 | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Purpose                        | Obtain and/or manage user status, user preferences, shares, sharees, recommendations. API is likely to be extended to other use cases in the future. Nextcloud apps can extend the functionality of OCS API by providing new endpoints |
-| Versioning                     | Identical with component release version                                                                                                                                                                                               |
+| Versioning                     | Identical to component release version                                                                                                                                                                                                  |
 | Authentication                 | Basic Auth or by passing a set of valid session cookies                                                                                                                                                                                |
 | In openDesk provided by        | Nextcloud Server                                                                                                                                                                                                                       |
 | Transport protocol             | HTTP(S)                                                                                                                                                                                                                                |
 | Usage within component         | none                                                                                                                                                                                                                                   |
-| Usage within openDesk          | Filepicker is using the API to create share links.                                                                                                                                                                                     |
+| Usage within openDesk          | Filepicker uses the API to create share links.                                                                                                                                                                                         |
 | Usage for external integration | none                                                                                                                                                                                                                                   |
 | Parallel access                | Allowed                                                                                                                                                                                                                                |
 | Message protocol               | Requests in JSON, responses in JSON or XML                                                                                                                                                                                             |
@@ -415,49 +417,49 @@ Following are APIs used by the Files application:
 
 ## Activity API
 
-| Name                           | Activity API                                                                                                                                           |
-| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Purpose                        | Allows to obtain the list of actions initiated or involving a specific user (files created, shared, deleted etc and other activities reported by apps) |
-| Versioning                     | Identical with component release version                                                                                                               |
-| Authentication                 | See linked documentation (which also names the version), address via URL path, e.g. `/ocs/v2.php/apps/activity/api/v2`                                 |
-| In openDesk provided by        | Nextcloud Server                                                                                                                                       |
-| Transport protocol             | HTTP(S)                                                                                                                                                |
-| Usage within component         | none                                                                                                                                                   |
-| Usage within openDesk          | none                                                                                                                                                   |
-| Usage for external integration | none                                                                                                                                                   |
-| Parallel access                | Allowed                                                                                                                                                |
-| Message protocol               | Requests in JSON, responses in JSON or XML                                                                                                             |
-| Supported standards            |                                                                                                                                                        |
-| Documentation                  | https://github.com/nextcloud/activity/blob/master/docs/endpoint-v2.md                                                                                  |
+| Name                           | Activity API                                                                                                                                       |
+| ------------------------------ |----------------------------------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Obtaining the list of actions initiated by or involving a specific user (files created, shared, deleted etc and other activities reported by apps) |
+| Versioning                     | Identical to component release version                                                                                                           |
+| Authentication                 | See linked documentation (which also names the version), address via URL path, e.g. `/ocs/v2.php/apps/activity/api/v2`                             |
+| In openDesk provided by        | Nextcloud Server                                                                                                                                   |
+| Transport protocol             | HTTP(S)                                                                                                                                            |
+| Usage within component         | none                                                                                                                                               |
+| Usage within openDesk          | none                                                                                                                                               |
+| Usage for external integration | none                                                                                                                                               |
+| Parallel access                | Allowed                                                                                                                                            |
+| Message protocol               | Requests in JSON, responses in JSON or XML                                                                                                         |
+| Supported standards            |                                                                                                                                                    |
+| Documentation                  | https://github.com/nextcloud/activity/blob/master/docs/endpoint-v2.md                                                                              |
 
 ## Remote wipe API
 
-| Name                           | Remote wipe API                                                                             |
-| ------------------------------ | ------------------------------------------------------------------------------------------- |
-| Purpose                        | Used to wipe storage remotely (e.g. on a lost device)                                       |
-| Versioning                     | Identical with component release version                                                    |
-| Authentication                 | Login flow token                                                                            |
-| In openDesk provided by        | Nextcloud Server                                                                            |
-| Transport protocol             | HTTP(S)                                                                                     |
-| Usage within component         | none                                                                                        |
-| Usage within openDesk          | none                                                                                        |
-| Usage for external integration | none                                                                                        |
-| Parallel access                | Allowed                                                                                     |
-| Message protocol               | JSON                                                                                        |
-| Supported standards            |                                                                                             |
+| Name                           | Remote wipe API                                                                            |
+| ------------------------------ |--------------------------------------------------------------------------------------------|
+| Purpose                        | Used to wipe storage remotely (e.g. on a lost device)                                      |
+| Versioning                     | Identical to component release version                                                     |
+| Authentication                 | Login flow token                                                                           |
+| In openDesk provided by        | Nextcloud Server                                                                           |
+| Transport protocol             | HTTP(S)                                                                                    |
+| Usage within component         | none                                                                                       |
+| Usage within openDesk          | none                                                                                       |
+| Usage for external integration | none                                                                                       |
+| Parallel access                | Allowed                                                                                    |
+| Message protocol               | JSON                                                                                       |
+| Supported standards            |                                                                                            |
 | Documentation                  | https://docs.nextcloud.com/server/latest/developer_manual/client_apis/RemoteWipe/index.html |
 
 ## WebDAV
 
 | Name                           | WebDAV                                                                                  |
-| ------------------------------ | --------------------------------------------------------------------------------------- |
-| Purpose                        | Accessing files and folders, conducting search                                          |
-| Versioning                     | Identical with component release version                                                |
+| ------------------------------ |-----------------------------------------------------------------------------------------|
+| Purpose                        | Accessing files and folders, conducting searches                                        |
+| Versioning                     | Identical to component release version                                                  |
 | Authentication                 | Basic Auth or by passing a set of valid session cookies                                 |
 | In openDesk provided by        | Nextcloud Server                                                                        |
 | Transport protocol             | HTTP(S)                                                                                 |
 | Usage within component         | none                                                                                    |
-| Usage within openDesk          | Used by OX AppSuite to put/retrieve files (attachments)                                 |
+| Usage within openDesk          | Used by OX AppSuite to get/put files (attachments)                                      |
 | Usage for external integration | none                                                                                    |
 | Parallel access                | Allowed                                                                                 |
 | Message protocol               | Requests in JSON, responses in JSON or XML                                              |
@@ -470,7 +472,7 @@ CalDAV and CardDAV APIs are available in Nextcloud, but as openDesk uses OX AppS
 
 # Weboffice - Collabora
 
-Following are APIs used by the Weboffice application:
+The following are the APIs used by the Weboffice application:
 
 | Used by   | Accessed component | Service           | Purpose                                     | Message format |
 | --------- | ------------------ | ----------------- | ------------------------------------------- | -------------- |
@@ -494,20 +496,20 @@ sequenceDiagram
 
 ## PostMessage API
 
-| Name                           | PostMessage API                                                                                                                                 |
-| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- |
-| Purpose                        | Interact with parent frame when Collabora browser part is enclosed in one, mostly based on WOPI specification with few extensions/modifications |
-| Versioning                     | N/A                                                                                                                                             |
-| Authentication                 | CSP rules protect unauthorized communication. In practice editor is embedded in an iframe and can communicate only with the iframe's parent.    |
-| In openDesk provided by        | Collabora                                                                                                                                       |
-| Transport protocol             | HTTP                                                                                                                                            |
-| Usage within component         | N/A                                                                                                                                             |
-| Usage within openDesk          | Query number of users in a document, query supported export formats, manage sessions, manage actions like save, insert image, print etc.        |
-| Usage for external integration | In openDesk Collabora Online is integrated with Nextcloud but other integrations exist and are possible, see the documentation.                 |
-| Parallel access                | Allowed                                                                                                                                         |
-| Message protocol               | JSON                                                                                                                                            |
-| Supported standards            | [WOPI](https://learn.microsoft.com/en-us/openspecs/office_protocols/ms-wopi/6a8bb410-68ad-47e4-9dc3-6cf29c6b046b)                               |
-| Documentation                  | https://sdk.collaboraonline.com/docs/postmessage_api.html                                                                                       |
+| Name                           | PostMessage API                                                                                                                                   |
+| ------------------------------ |---------------------------------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Interact with parent frame when Collabora browser part is enclosed in one, mostly based on WOPI specification with few extensions/modifications   |
+| Versioning                     | N/A                                                                                                                                               |
+| Authentication                 | CSP rules protect unauthorized communication. In practice, the editor is embedded in an iframe and can communicate only with the iframe's parent. |
+| In openDesk provided by        | Collabora                                                                                                                                         |
+| Transport protocol             | HTTP                                                                                                                                              |
+| Usage within component         | N/A                                                                                                                                               |
+| Usage within openDesk          | Query the number of users in a document, query supported export formats, manage sessions, manage actions like save, insert image, print etc.      |
+| Usage for external integration | In openDesk Collabora Online is integrated with Nextcloud but other integrations exist and are possible, see the documentation.                   |
+| Parallel access                | Allowed                                                                                                                                           |
+| Message protocol               | JSON                                                                                                                                              |
+| Supported standards            | [WOPI](https://learn.microsoft.com/en-us/openspecs/office_protocols/ms-wopi/6a8bb410-68ad-47e4-9dc3-6cf29c6b046b)                                 |
+| Documentation                  | https://sdk.collaboraonline.com/docs/postmessage_api.html                                                                                         |
 
 ## Conversion API
 
@@ -522,13 +524,13 @@ sequenceDiagram
 | Usage within openDesk          | To generate thumbnails in Nextcloud for supported document types.                                       |
 | Usage for external integration | It is possible to set up Collabora Online as a general document converter service.                      |
 | Parallel access                | Allowed                                                                                                 |
-| Message protocol               | text based, see the documentation                                                                                                        |
+| Message protocol               | Text based, see the documentation                                                                       |
 | Supported standards            | N/A                                                                                                     |
 | Documentation                  | https://sdk.collaboraonline.com/docs/conversion_api.html                                                |
 
 # Project management - OpenProject
 
-Following are APIs used by the Project management application:
+The following are the APIs used by the Project management application:
 
 | Used by         | Accessed component | Service            | Purpose                                            | Message format |
 | --------------- | ------------------ | ------------------ | -------------------------------------------------- | -------------- |
@@ -565,50 +567,50 @@ Following are APIs used by the Project management application:
 
 *How does it work? (What do users need to know about architecture an internal components?)*
 - HAL is a standard to define resources with embedding and links between them
-- HAL contains action links depending on the user’s permissions, allows to derive allowed actions from object keys in json
+- HAL contains action links depending on the user’s permissions, allows permitted actions to be derived from object keys in json
 
-*What knowledge prerequisites for the developer before using the API?*
+*What knowledge should the developer have before using the API?*
 - Knowledge of REST
 - (Optional) Knowledge of HAL standard
 
-*Any extensions or APIs in development or in planning users should know about?*
+*Are there any extensions or APIs in (or planned for) development that users should know about?*
 - Signaling to receive only selected attributes/nested resources from the API for performance improvements
 
 ## BCF API
 
-| Name                           | BCF API                                                                                                                                                                            |
-| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Purpose                        | Implementation of subset of [BCF](https://en.wikipedia.org/wiki/BIM_Collaboration_Format) standard for [BIM](https://en.wikipedia.org/wiki/Building_information_modeling) projects |
-| Versioning                     | URL based versioning scheme, e.g. `/api/bcf/2.1`                                                                                                                                   |
-| Authentication                 | OAuth2                                                                                                                                                                             |
-| In openDesk provided by        | OpenProject                                                                                                                                                                        |
-| Transport protocol             | HTTP(S)                                                                                                                                                                            |
-| Usage within component         | none                                                                                                                                                                               |
-| Usage within openDesk          | none                                                                                                                                                                               |
-| Usage for external integration | none                                                                                                                                                                               |
-| Parallel access                | Allowed                                                                                                                                                                            |
-| Message protocol               | JSON                                                                                                                                                                               |
-| Supported standards            | [BCF 2.1](https://github.com/buildingSMART/BCF-API/blob/release_2_1/README.md)                                                                                                     |
-| Documentation                  | https://www.openproject.org/docs/api/bcf-rest-api/                                                                                                                                 |
+| Name                           | BCF API                                                                                                                                                                              |
+| ------------------------------ |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Implementation of a subset of [BCF](https://en.wikipedia.org/wiki/BIM_Collaboration_Format) standard for [BIM](https://en.wikipedia.org/wiki/Building_information_modeling) projects |
+| Versioning                     | URL based versioning scheme, e.g. `/api/bcf/2.1`                                                                                                                                     |
+| Authentication                 | OAuth2                                                                                                                                                                               |
+| In openDesk provided by        | OpenProject                                                                                                                                                                          |
+| Transport protocol             | HTTP(S)                                                                                                                                                                              |
+| Usage within component         | none                                                                                                                                                                                 |
+| Usage within openDesk          | none                                                                                                                                                                                 |
+| Usage for external integration | none                                                                                                                                                                                 |
+| Parallel access                | Allowed                                                                                                                                                                              |
+| Message protocol               | JSON                                                                                                                                                                                 |
+| Supported standards            | [BCF 2.1](https://github.com/buildingSMART/BCF-API/blob/release_2_1/README.md)                                                                                                       |
+| Documentation                  | https://www.openproject.org/docs/api/bcf-rest-api/                                                                                                                                   |
 
 # Video Conferencing - Jitsi
 
 ## IFrame API
 
-| Name                           | IFrame API                                                             |
-| ------------------------------ | ---------------------------------------------------------------------- |
-| Purpose                        | Embed Jitsi video conferencing features into existing application/site |
-| Versioning                     | Identical to the Jitsi release version                                 |
-| Authentication                 | Optional (JWT-based authentication in openDesk context)                |
-| In openDesk provided by        | Jitsi-Web                                                              |
-| Transport protocol             | HTTP(S)                                                                |
-| Usage within component         | none                                                                   |
-| Usage within openDesk          | Used by Element (Chat Web-UI)                                          |
-| Usage for external integration | none                                                                   |
-| Parallel access                | Allowed                                                                |
-| Message protocol               |                                                                        |
-| Supported standards            |                                                                        |
-| Documentation                  | https://jitsi.github.io/handbook/docs/dev-guide/dev-guide-iframe/      |
+| Name                           | IFrame API                                                               |
+| ------------------------------ |--------------------------------------------------------------------------|
+| Purpose                        | Embed Jitsi video conferencing features into existing applications/sites |
+| Versioning                     | Identical to the Jitsi release version                                   |
+| Authentication                 | Optional (JWT-based authentication in openDesk context)                  |
+| In openDesk provided by        | Jitsi-Web                                                                |
+| Transport protocol             | HTTP(S)                                                                  |
+| Usage within component         | none                                                                     |
+| Usage within openDesk          | Used by Element (Chat Web-UI)                                            |
+| Usage for external integration | none                                                                     |
+| Parallel access                | Allowed                                                                  |
+| Message protocol               |                                                                          |
+| Supported standards            |                                                                          |
+| Documentation                  | https://jitsi.github.io/handbook/docs/dev-guide/dev-guide-iframe/        |
 
 ## lib-jitsi-meet API
 
@@ -702,7 +704,7 @@ classDiagram
     JitsiVideoConference *-- JitsiMeetReactSdk
 ```
 
-Following are APIs used by the Chat application:
+The following are the APIs used by the Chat application:
 
 | Used by         | Accessed component | Service            | Purpose                                            | Message format |
 | --------------- | ------------------ | ------------------ | -------------------------------------------------- | -------------- |
@@ -746,8 +748,8 @@ Following are APIs used by the Chat application:
 ## Matrix Server-Server API
 
 | Name                           | Matrix Server-Server API                                                                                                                     |
-| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
-| Purpose                        | Communication between Matrix server (also known as FederationAPIs)                                                                           |
+| ------------------------------ |----------------------------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Communication between Matrix servers (also known as FederationAPIs)                                                                          |
 | Versioning                     | URL based with version bumps on breaking changes (e.g. `/_matrix/federation/v2`)                                                             |
 | Authentication                 | HTTP-Authorization header with Bearer token                                                                                                  |
 | In openDesk provided by        | Synapse                                                                                                                                      |
@@ -864,7 +866,7 @@ Following are APIs used by the Chat application:
 
 # Knowledge management - XWiki
 
-Following are APIs used by the Knowledge management application:
+The following are the APIs used by the Knowledge management application:
 
 | Used by | Accessed component | Service            | Purpose                                            | Message format |
 | ------- | ------------------ | ------------------ | -------------------------------------------------- | -------------- |
@@ -875,8 +877,8 @@ Following are APIs used by the Knowledge management application:
 ## REST API
 
 | Name                           | REST API                                                                                                                                                                                                                                                   |
-| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Purpose                        | Perform low level action, e.g. interact with XWiki stored data                                                                                                                                                                                             |
+| ------------------------------ |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Perform low-level actions, e.g. interact with XWiki stored data                                                                                                                                                                                            |
 | Versioning                     |                                                                                                                                                                                                                                                            |
 | Authentication                 | Anonymous or username/password on each request (stateless)                                                                                                                                                                                                 |
 | In openDesk provided by        | XWiki                                                                                                                                                                                                                                                      |
@@ -895,7 +897,7 @@ Following are APIs used by the Knowledge management application:
 | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Purpose                        | Feature-rich API to access any module, use any functionality, modify existing functionality; allows definition of new REST API endpoints - API scope is identical to Java API |
 | Versioning                     |                                                                                                                                                                               |
-| Authentication                 | Executed in context of (authenticated) user or anonymous - permissions (scripting rights, programming rights) of that context apply                                           |
+| Authentication                 | Performed in the context of an (authenticated) user or anonymously - permissions (scripting rights, programming rights) of that context apply                                 |
 | In openDesk provided by        | XWiki                                                                                                                                                                         |
 | Transport protocol             |                                                                                                                                                                               |
 | Usage within component         |                                                                                                                                                                               |
@@ -912,7 +914,7 @@ Following are APIs used by the Knowledge management application:
 | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Purpose                        | Feature-rich API to access any module, use any functionality, modify existing functionality; allows definition of new REST API endpoints - API scope is identical to Scripting API |
 | Versioning                     |                                                                                                                                                                                    |
-| Authentication                 | Executed in context of (authenticated) user or anonymous - but without the permission check (in opposite to the Scripting API)                                                     |
+| Authentication                 | Performed in the context of an (authenticated) user or anonymously - but without the permission check (in contrast to the Scripting API)                                           |
 | In openDesk provided by        | XWiki                                                                                                                                                                              |
 | Transport protocol             |                                                                                                                                                                                    |
 | Usage within component         |                                                                                                                                                                                    |
@@ -929,7 +931,7 @@ Following are APIs used by the Knowledge management application:
 | ------------------------------ | -------------------------------------------------------------------------------------------- |
 | Purpose                        | Include dynamic components in XWiki/web pages                                                |
 | Versioning                     |                                                                                              |
-| Authentication                 | Executed in context of (authenticated) user or anonymous                                     |
+| Authentication                 | Performed in the context of an (authenticated) user or anonymously                           |
 | In openDesk provided by        | Jitsi                                                                                        |
 | Transport protocol             |                                                                                              |
 | Usage within component         |                                                                                              |

docs/baseline-requirements.md

@@ -0,0 +1,276 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Baseline Requirements</h1>
+
+* [Preamble / Scope](#preamble--scope)
+* [Software bill of materials (SBOMs)](#software-bill-of-materials-sboms)
+  * [Artifact SBOMs](#artifact-sboms)
+  * [Source code SBOMs](#source-code-sboms)
+* [License Compliance](#license-compliance)
+* [Software supply chain security](#software-supply-chain-security)
+* [Container architectural basics](#container-architectural-basics)
+* [Security](#security)
+  * [IT-Grundschutz](#it-grundschutz)
+* [Accessibility](#accessibility)
+* [Data protection](#data-protection)
+* [Functionality and features](#functionality-and-features)
+  * [Non-overlapping](#non-overlapping)
+  * [User lifecycle](#user-lifecycle)
+    * [Pull: LDAP](#pull-ldap)
+    * [Push: Provisioning](#push-provisioning)
+  * [Authentication](#authentication)
+  * [Top bar](#top-bar)
+    * [Look and feel](#look-and-feel)
+    * [Central navigation](#central-navigation)
+  * [Functional Administration](#functional-administration)
+  * [Theming](#theming)
+  * [Central user profile](#central-user-profile)
+* [Footnotes](#footnotes)
+
+# Preamble / Scope
+
+This document lays out the requirements for open-source products that should become part of openDesk.
+
+As this is a comprehensive set of requirements most new components will not adhere to all of them.
+
+This document can be used to assess the status and possible gaps for a component which might itself be the basis for a decision if a component should be integrated into openDesk by working on closing the identified gaps.
+
+> **Note**<br>
+> Even an already integrated application might not adhere to all aspects of the documented requirements yet.
+> Closing the gaps for existing applications therefore is an openDesk priority.
+
+# Software bill of materials (SBOMs)
+
+openDesk is looking into options for in-depth SBOM creation first for container images and later for source code. It is still expected by the suppliers to provide artifact and source code SBOMs in a standardized manner, ideally in the openCode preferred [SPDX 2.2.1](https://spdx.org/rdf/ontology/spdx-2-2-1/) format.
+
+**Reference:** https://gitlab.opencode.de/bmi/opendesk/deployment/SBOM/-/tree/main/sboms/0.5.74
+
+## Artifact SBOMs
+
+There are various free tools like [syft](https://github.com/anchore/syft) available to generate SBOMs for container images. It is expected that this kind of artifact SBOMs is provided (and signed) for all containers delivered to be integrated into openDesk.
+
+**Reference:** As part of [openDesk's standard CI](https://gitlab.opencode.de/bmi/opendesk/tooling/gitlab-config) a container image SBOM is derived from the container's content and gets signed. Both artifacts (SBOM and signature) are placed next to the image in the related registry ([e.g.](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release/container_registry/827)).
+
+## Source code SBOMs
+
+Today's software development platforms like GitLab or GitHub provide dependency list/graph features that are the basis for your source code SBOMs. These features are usually based on analysis of language-specific package manager dependency definition files. As part of a supplier's software development process, it is expected that source code SBOMs are at least created on the level of the already defined software dependencies within the source code tree of the component.
+
+**Reference:** Currently we do not have source code SBOMs in place.
+
+# License Compliance
+
+All parts of openDesk Community Edition must be open source with source code (also) published or at least publishable on openCode.
+
+openCode provides some boundaries when it comes to open source license compliance openDesk has to adhere to:
+
+- The components must be published under a license listed in the [openCode license allow list](https://wikijs.opencode.de/de/Hilfestellungen_und_Richtlinien/Lizenzcompliance#h-2-open-source-lizenzliste).
+- Delivered artifacts (container images) must contain only components licensed under the aforementioned allow list. A container must not contain any artifact using a license from the [openCode license block list](https://wikijs.opencode.de/de/Hilfestellungen_und_Richtlinien/Lizenzcompliance#h-3-negativliste-aller-nicht-freigegebenen-lizenzen).
+
+Deviations from the above requirements must be documented in the openDesk license deviation report.
+
+**Reference:** https://gitlab.opencode.de/bmi/opendesk/deployment/SBOM/-/blob/main/sboms/openDesk%20Deviation%20Report-0.5.74.md
+
+# Software supply chain security
+
+ZenDiS plans to provide secured key storage as a service on openCode.
+
+openDesk is going to implement [SLSA v1.0](https://slsa.dev/spec/v1.0/).
+
+The minimum requirement for all of openDesk's functional components is that all component artifacts (i.e. container images, Helm charts) are signed and their signature can be verified based on the ZenDiS-provided secure key store.
+
+**Reference:** The [openDesk standard CI](https://gitlab.opencode.de/bmi/opendesk/tooling/gitlab-config) ensures that each container image being built and each Helm chart being released is signed. In the case of container images, the related SBOMs are signed as well.
+
+# Container architectural basics
+
+Note: openDesk is operated as a Kubernetes (K8s) workload.
+
+openDesk applications should adhere to best practices for K8s application/container design. While there are dozens of documents about these best practices please use them as references:
+- https://cloud.google.com/architecture/best-practices-for-building-containers
+- https://cloud.google.com/architecture/best-practices-for-operating-containers
+
+As some applications were initially created years before K8s was introduced they naturally might take different approaches.
+
+You will find below some of the most common best practice requirements, some of which are auto-tested as part of the openDesk deployment automation:
+
+- Containers come with readiness and liveness probes.
+- Containers are stateless and immutable (read-only root file system), state should be placed into a database (or similar).
+- Allow horizontal scaling (auto-scaling is of course nice to have).
+- Provide resource requests and limits (we do not want to limit CPU though).
+- Provide application-specific monitoring endpoints and expose the health of the application.
+- Write your logs to STDOUT/STDERR and ideally provide JSON-based logs.
+- Use one service per container (microservice pattern).
+- Minimize the footprint of your container e.g. removing unnecessary tools, ideally providing a distroless container.
+- Allow restrictive setting of the security contexts (see [security-context.md](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/docs/security-context.md) for reference).
+- Support for external secrets.
+- Support for externally provided/self-signed certificates.
+
+**Reference:** Some of these requirements are tested and/or documented within the deployment automation:
+- CI executed Kyverno tests: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/tree/main/.kyverno/policies
+- Generated documentation regarding security contexts: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/docs/security-context.md
+
+# Security
+
+openDesk should be compliant with the "Deutsche Verwaltungscloud Strategie" (DVS). While this is a moving target it references some already established standards like the BSI's [IT-Grundschutz](https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/IT-Grundschutz/IT-Grundschutz-Kompendium/it-grundschutz-kompendium_node.html) and [C5](https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5_AktuelleVersion/C5_AktuelleVersion_node.html). These standards address hundreds of requirements which are published at the given links. So here's just a summary to understand the approach of the broadest requirements from IT-Grundschutz.
+
+**Reference:** [Deutsche Verwaltungscloud-Strategie – Rahmenwerk der Zielarchitektur](https://www.cio.bund.de/SharedDocs/downloads/Webs/CIO/DE/cio-bund/steuerung-it-bund/beschluesse_cio-board/2023_11_Beschluss_CIO_Board_DVS_Rahmenwerk_Anlage.pdf)
+
+## IT-Grundschutz
+
+The IT-Grundschutz catalog knowns a lot of modules ("Bausteine"), but not all of them apply to all components, as there are some related to hardware or some just relevant for the operator while openDesk is "just" the software platform. The first step for an IT-Grundschutz evaluation of a component (or the platform as a whole) requires defining which modules are applicable. Other modules apply to all components e.g. [APP.4.4 Kubernetes](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-GS-Kompendium_Einzel_PDFs_2023/06_APP_Anwendungen/APP_4_4_Kubernetes_Edition_2023.pdf), [SYS.1.6 Containerisierung](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-GS-Kompendium_Einzel_PDFs_2023/07_SYS_IT_Systeme/SYS_1_6_Containerisierung_Edition_2023.pdf) and [CON.2 Datenschutz](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-GS-Kompendium_Einzel_PDFs_2023/03_CON_Konzepte_und_Vorgehensweisen/CON_2_Datenschutz_Edition_2023.pdf).
+
+Within each module are multiple requirements ("Anforderungen") that are usually composed of multiple partial requirements ("Teilanforderungen"). Each requirement has a given category:
+- B for basic ("Basis") - the requirement must be fulfilled.
+- S for standard ("Standard") - the requirement should also be fulfilled, if not there must be a good reason why it is not the case that does not tamper the security of the overall system. There is only a defined amount of deviations allowed for standard requirements.
+- H for high ("Hoch") - in certain scenarios you have extended security requirements, in that case, the high requirements must be fulfilled. openDesk is working towards making that possible.
+
+Different requirements address different roles in IT-Grundschutz.
+
+- Supplier: processes & product (component -> e.g. Open-Xchange, OpenProject)
+- Provider: processes & product (platform -> openDesk)
+- Operator: processes & product (service)
+- Customer: processes.
+
+As a supplier of an openDesk component, you will focus on the "Supplier" requirements, while the outcome (your product) must enable the Provider to fulfill the requirements that lay with its responsibility for the openDesk platform. Operators use openDesk to provide a service, therefore the openDesk platform must enable an Operator to fulfill the related requirements. Finally, the service must enable the customer to align with the scope of the IT-Grundschutz catalog. So it will happen that a requirement from e.g. the customer level needs a specific capability by the product (Supplier's responsibility), a defined core configuration from the platform (Provider's responsibility), or a certain service setup from the Operator.
+
+We are aware that IT-Grundschutz is a complex topic and are working towards a streamlined process to reduce overhead as much as possible and ensure to maximize the use of synergies.
+
+**Reference:** https://gitlab.opencode.de/bmi/opendesk/documentation/it-grundschutz
+
+# Accessibility
+
+Accessibility is a key requirement for software that is being used in the public sector. Therefore the products of the suppliers are expected to adhere to the relevant standards.
+
+Please find more context about the topic on the [website of the German CIO](https://www.cio.bund.de/Webs/CIO/DE/digitaler-wandel/it-barrierefreiheit/vorgaben-und-richtlinien/vorgaben-und-richtlinien-node.html) followed by a more detailed look at the actual accessibility standard [WCAG 2.1](https://www.barrierefreiheit-dienstekonsolidierung.bund.de/Webs/PB/DE/gesetze-und-richtlinien/wcag/wcag-artikel.html).
+
+Each vendor must provide a certificate that their product - or the parts of the product relevant for openDesk - complies with at least WCAG 2.1 AA or [BITV 2.0](https://www.bundesfachstelle-barrierefreiheit.de/DE/Fachwissen/Informationstechnik/EU-Webseitenrichtlinie/BGG-und-BITV-2-0/Die-neue-BITV-2-0/die-neue-bitv-2-0_node.html). As the certification and related product improvements are time-consuming the focus of openDesk is that a supplier provides a plan and certification partner (contract) that shows the supplier is working towards the certification. While the aforementioned standard states the priority is the "A" level requirements, the "AA" level must be met at the end of the process.
+
+> **Note**<br>
+> Please keep in mind that WCAG 2.2 and 3.0 are work in progress. If you already work on accessibility improvements you might want to take these standards already into consideration.
+
+**Reference:** In the past the [accessibility evaluations](https://gitlab.opencode.de/bmi/opendesk/info/-/tree/main/24.03/Barrierefreiheit) have been executed by Dataport. But they do not do certifications.
+
+# Data protection
+
+Each component must be able to operate according to the [EU's General Data Protection Regulation (GDPR)](https://gdpr.eu/). This requires some key messages to be answered when it comes to personal data[^1]:
+
+- Who are the affected data subjects?
+- What personal data (attributes) from the subjects is being processed?
+- Who is the controller and processor of the subject's data?
+- Which processing activities involve which data attributes?
+- How can the data be deleted?
+- Are personal data-related activities traceable?
+- How can data be provided uniformly to affected people?
+- What does a data privacy-friendly configuration look like?
+
+While this can be answered by each component that will be in the spotlight for the suppliers, we also need an aligned overall picture for openDesk that at least has the platform-specific user lifecycle and cross-application interfaces in focus.
+
+Note: The topics of availability, integrity, and confidentiality of personal data are also being addressed by the IT-Grundschutz module "CON.2". It has to be ensured that it is not in contradiction to what is being done in the general area of data protection.
+
+**Reference:** https://gitlab.opencode.de/bmi/opendesk/documentation/datenschutz
+
+# Functionality and features
+
+## Non-overlapping
+
+To avoid having functionality twice in openDesk it might be required to disable certain functionality within a component. There needs to be an assessment for each new component if it has overlapping functionality and how to deal with that.
+
+**Reference:** The contact management from Nextcloud is done in OX, so Nextcloud has its internal contact management disabled, as well as most of the Nextcloud Talk functionality, due to the presence of Element and Jitsi.
+
+## User lifecycle
+
+With a central Identity- and Access Management (IAM) also the user lifecycle (ULC) that addresses account create-update-delete actions with support for "inactive" accounts must be harmonized within the platform.
+
+The focus is to have all the account information in all applications including the account's state, profile picture ([reference](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues/27)) and - where required - the user's group memberships. This cannot be done purely by pushing that data through OIDC claims when a user logs in to an application therefore two ways of managing an account are applicable and described in the following subchapters.
+
+> **Note**<br>
+> Allowing ad hoc updates of account data through OIDC claims during login is still encouraged.
+
+### Pull: LDAP
+
+Applications can access the IAM's LDAP to access all data necessary for managing their part of the ULC.
+
+**Reference:** Most applications use LDAP access as per https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/docs/components.md?ref_type=heads#identity-data-flows
+
+> **Note**<br>
+> The direct access to LDAP is going to be deprecated for most use cases. openDesk is looking into active provisioning of the user/group data into the applications using [SCIM](https://scim.cloud/).
+
+### Push: Provisioning
+
+Some applications require active provisioning of the centrally maintained IAM data. As the actual provisioning is part of the openDesk provisioning framework it is necessary to define the ULC flow regarding its different states to get a matching provisioning connector implemented. This is done collaboratively between the supplier and openDesk product management.
+
+**Reference:** New applications will make use of the [provisioning framework](https://gitlab.opencode.de/bmi/opendesk/component-code/crossfunctional/univention/ums-provisioning-api). At the moment to only active (push) provisioned component is OX AppSuite fed by the [OX-connector](https://github.com/univention/ox-connector/tree/ucs5.0).
+
+## Authentication
+
+The central IdP ensures the single sign-on and logout workflows. As standard openDesk uses [Open ID Connect](https://openid.net/). It can be configured to provide additional user information from the IAM when required by a component.
+
+Minimum requirements regarding the OIDC support in an application besides the actual login flow:
+
+- Back-channel logout: [OIDC Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html) must be supported by the components unless there is a significant reason why it technically cannot be supported, in that case [OIDC Front-Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html) is the alternative.
+- IdP Session Refresh: Ensure that your application regularly checks the IdP session for its validity and invalidates the local session when there is no longer an IdP session.
+
+**Reference:** Most applications are directly connected to the IdP and are using OIDC: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/docs/architecture.md#identity-data-flows
+
+## Top bar
+
+The top bar of all applications should provide a common UX.
+
+### Look and feel
+
+The current status is subject to review, but the basics will most likely stay the same. Ensure that the top bar can be customized (or adheres to a given openDesk standard) in various settings:
+
+- Size (height) of the bar.
+- Foreground and -background colors, including hover/active.
+- Size and color of the bar's bottom line.
+- Logo position, size, and link including the link's target.
+- Icon position and size of the central navigation.
+- Ideally have the user's menu on the right-hand side of the top bar using the user's profile picture.
+- Have the search option/bar as the leftmost option in the right content section of the top bar or even allow the search bar to be rendered in the center of the top bar.
+
+**Reference:** This is available in current deployments, see e.g. Nextcloud, Open-Xchange, and XWiki.
+
+### Central navigation
+
+From the top bar, the user can access the central navigation. A menu that gets its contents from the portal, rending the categories and (sub-)applications available to the logged-in user.
+
+When implementing the central navigation into an application there are two options to access the user's data from the portal:
+
+- Frontend-based: Issuing an IFrame-based silent login against the intercom service (ICS) to get a session with the ICS, followed by a request for the JSON containing the user's central navigation contents through the ICS.
+- Backend-based: Requesting the JSON using a backend call to the portal providing the user's name and a shared secret.
+
+**Reference:** This is available in current deployments in all applications except for Jitsi, Collabora, and CryptPad.
+
+## Functional Administration
+
+While applications usually support technical and functional administration the technical part should be in the responsibility of the operator and is usually done at (re)deployment time. Therefore the administrative tasks within an application should be limited to functional administration.
+
+Example for "technical administration":
+- Configuring the SMTP relay for an application to send out emails.
+
+Example of "functional administration":
+- Creating and maintaining users and groups.
+
+**Reference:** OpenProject took the approach that all settings pre-defined in the deployment are still rendered in the admin section of OpenProject, but can not be changed.
+
+## Theming
+
+Theming should be controlled with the deployment and affect all components that support branding options.
+
+**Reference:** https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues/27
+
+## Central user profile
+
+The user profile is maintained centrally, therefore the applications should make use of that central data and not allow local editing of the data within the application except for data that is required by the application and cannot be provided by the central IAM.
+
+The data can still be rendered but must not be tampered with in any way within an openDesk application outside of the IAM, as it would either cause inconsistent data within the platform or the changed data being overwritten, which is at least unexpected by the user.
+
+The user's preferred language and theme (light/dark) are also selected in the IAM's portal and the setting should be respected in all applications.
+
+**Reference:** No reference yet.
+
+# Footnotes
+
+^1: For definitions see [GDPR Article 4](https://gdpr.eu/article-4-definitions/).

docs/data-storage.md

@@ -18,7 +18,7 @@ following subsection.
 
 The provided diagram shows all relevant openDesk applications on the left and
 their utilized data storages on the right. For more detailed information about each
-application refer to the table show in Section [Details](#details)
+application refer to the table in [Details](#details).
 
 ```mermaid
 ---

docs/debugging.md

@@ -18,11 +18,13 @@ SPDX-License-Identifier: Apache-2.0
   * [OpenProject](#openproject)
   * [PostgreSQL](#postgresql)
   * [Keycloak](#keycloak)
+    * [Setting the log level](#setting-the-log-level)
+    * [Accessing the Keycloak admin console](#accessing-the-keycloak-admin-console)
 <!-- TOC -->
 
 # Disclaimer
 
-This document collects information on how to deal with debugging an openDesk deployment.
+This document collects information on how to go about debugging an openDesk deployment.
 
 It will be extended over time as we deal with debugging cases.
 
@@ -36,7 +38,7 @@ environments, you should use them thoughtfully and carefully if needed.
 
 # Enable debugging
 
-Check the openDesk [`debug.yaml.gotmpl`](../helmfile/environments/default/debug.yaml.gotmpl) and set for your deployment
+Check the openDesk [`debug.yaml.gotmpl`](../helmfile/environments/default/debug.yaml.gotmpl) and configure it for your deployment
 ```
 debug:
   enabled: true
@@ -45,13 +47,13 @@ debug:
 This will result in:
 - setting most component's log level to debug
 - making the Keycloak admin console available by default at `https://id.<your_domain>/admin/`
-- configured the ingress for `http://minio-console.<your_domain>`
+- ingress for `http://minio-console.<your_domain>` being configured
 
 > **Note**<br>
 > When enabling debug mode and updating your deployment, you must manually delete all jobs before updating. In debug mode, we keep the jobs, and some job fields are immutable, leading to a deployment failure.
 
 > **Note**<br>
-> All containers should write their log output to STDOUT; if you find (valuable) logs inside a container, please let us know!
+> All containers should write their log output to STDOUT; if you find (valuable) logs inside a container which were not in STDOUT, please let us know!
 
 # Adding containers to a pod for debugging purposes
 
@@ -61,13 +63,13 @@ This can be a challenge the more security-hardened the container images are beca
 
 Adding a container to a Pod can ease the pain.
 
-Below are some wrap-up notes on debugging openDesk by adding debug containers. Of course, there are many more detailed resources out there.
+Below are some brief notes on debugging openDesk by adding debug containers. Of course, there are many more detailed resources out there.
 
 ## Adding a container to a pod/deployment - Dev/Test only
 
 You can add a container by editing and updating an existing deployment, which is quite comfortable with tools like [Lens](https://k8slens.dev/).
 
-- Select the container you want to make use of as a debugging container; in the example below, it is `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
+- Select the container you want to use as a debugging container; in the example below, it is `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
 - Ensure the `shareProcessNamespace` option is enabled for the Pod.
 - Reference the selected container within the `containers` array of the deployment.
 - If you want to access another container's filesystem, ensure both containers' user/group settings match.
@@ -96,29 +98,29 @@ The following example can be used to debug the `openDesk-Nextcloud-PHP` containe
 ```
 
 - After the deployment has been reloaded, open the shell of the debugging container.
-- When you've succeeded, you will see the processes of both/all containers in the Pod when doing a `ps aux`.
+- When you've succeeded, you will see the processes of both/all containers in the Pod when executing `ps aux`.
 - To access other containers' filesystems, select the PID of a process from the other container and do a `cd /proc/<selected_process_id>/root`.
 
 ## Temporary/ephemeral containers
 
-An interesting read we picked most of the details below from: https://iximiuz.com/en/posts/kubernetes-ephemeral-containers/
+An interesting read from which we picked most of the details below from: https://iximiuz.com/en/posts/kubernetes-ephemeral-containers/
 
 Sometimes, you do not want to add a container permanently to your existing deployment. In that case, you could use [ephemeral containers](https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/).
 
-For the commands further down this section, we set some environment variables first:
+For the commands further down this section, we need to set some environment variables first:
 - `NAMESPACE`: The namespace in which the Pod you want to inspect is running.
-- `DEPLOYMENT_NAME`: The deployment's name responsible for spawning the Pod you want to inspect within the pre-mentioned namespace.
-- `POD_NAME`: The name of the Pod you want to inspect within the pre-mentioned namespace.
-- `EPH_CONTAINER_NAME`: Choose the name for the container, and "debugging" seems obvious.
+- `DEPLOYMENT_NAME`: The deployment's name responsible for spawning the Pod you want to inspect within the aforementioned namespace.
+- `POD_NAME`: The name of the Pod you want to inspect within the aforementioned namespace.
+- `EPH_CONTAINER_NAME`: The name of your debugging container, "debugging" seems obvious.
 - `DEBUG_IMAGE`: The image you want to use for debugging purposes.
 
 e.g.
 
 ```shell
-export EPH_CONTAINER_NAME=debugging
 export NAMESPACE=my_test_deployment
 export DEPLOYMENT_NAME=opendesk-nextcloud-php
 export POD_NAME=opendesk-nextcloud-php-6686d47cfb-7642f
+export EPH_CONTAINER_NAME=debugging
 export DEBUG_IMAGE=registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest
 ```
 
@@ -145,7 +147,7 @@ kubectl -n ${NAMESPACE} attach -it -c ${EPH_CONTAINER_NAME} ${POD_NAME}
 
 ## Helmfile
 
-When refactoring the Helmfile structure you want to ensure that there are not unintended mistakes by e.g. `diff`
+When refactoring the Helmfile structure, you want to ensure that there are no unintended edits by executing e.g. `diff` and
 comparing the output of Helmfile from before and after the change by calling:
 
 ```shell
@@ -154,9 +156,9 @@ helmfile template -e dev >output_to_compare.yaml
 
 ## MariaDB
 
-When using the openDesk bundled MariaDB, you can explore the database(s) using the MariaDB interactive terminal from the Pod's command line: `mariadb -u root -p`. On the password prompt, provide the value for `MARIADB_ROOT_PASSWORD` found in the Pod's environment.
+When using the openDesk bundled MariaDB, you can explore the database(s) using the MariaDB interactive terminal from the Pod's command line: `mariadb -u root -p`. On the password prompt, provide the value for `MARIADB_ROOT_PASSWORD` which can be found in the Pod's environment.
 
-While you will find all the details for the CLI tool in [the online documentation](https://mariadb.com/kb/en/mariadb-command-line-client/), some quick commands are:
+While you will find all the details for the CLI tool in the [MariaDB documentation](https://mariadb.com/kb/en/mariadb-command-line-client/), some commonly used commands are:
 
 - `help`: Get help on the psql command set
 - `show databases`: Lists all databases
@@ -168,7 +170,7 @@ While you will find all the details for the CLI tool in [the online documentatio
 
 `occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).
 
-You can run occ commands in the `opendesk-nextcloud-php` pod like this: `php /var/www/html/occ config:list`
+You can run occ commands in the `opendesk-nextcloud-aio` pod like this: `php /var/www/html/occ config:list`
 
 ## OpenProject
 
@@ -188,7 +190,7 @@ end
 
 Using the openDesk bundled PostgreSQL, you can explore database(s) using the PostgreSQL interactive terminal from the Pod's command line: `psql -U postgres`.
 
-While you will find all details in the [psql subsection](https://www.postgresql.org/docs/current/app-psql.html)) of the PostgreSQL documentation, some quick commands are:
+While you will find all details about the cli tool `psql` in the [PostgreSQL documentation](https://www.postgresql.org/docs/current/app-psql.html)), some commonly used commands are:
 
 - `\?`: Get help on the psql command set
 - `\l`: Lists all databases
@@ -198,10 +200,11 @@ While you will find all details in the [psql subsection](https://www.postgresql.
 
 ## Keycloak
 
-Keycloak is the gateway to integrate other authentication management systems or applications. It can be desired to
-avoid enabling debug mode for the whole platform when you just need to look into Keycloak.
+### Setting the log level
 
-That can easily be achieved in two steps:
+Keycloak is the gateway to integrate other authentication management systems or applications. It is undesirable to enable debug mode for the whole platform if you just need to look into Keycloak.
+
+Enabling debugging mode for Keycloak can easily be achieved in two steps:
 
 1. Updating the value for `KC_LOG_LEVEL` in the related configmap `ums-keycloak`.
 ```shell
@@ -213,4 +216,10 @@ kubectl patch -n ${NAMESPACE} configmap ${CONFIGMAP_NAME} --type merge -p '{"dat
 2. Restart the Keycloak Pod(s).
 
 > **Note**<br>
-> As the `ums-keycloak-extensions-handler` is performing frequent (one per second) requests to Keycloak for retrieval of the Keycloak event history, you might want to stop/remove the deployment while debugging/analysing Keycloak to not get your debug output spammed by these requests.
+> Because the `ums-keycloak-extensions-handler` is sending frequent requests (one per second) to Keycloak for retrieval of the Keycloak event history, you might want to stop/remove the deployment while debugging/analysing Keycloak to not get your debug output spammed by these requests.
+
+### Accessing the Keycloak admin console
+
+Deployments set to `debug.enable: true` expose the Keycloak admin console at `http://id.<your_opendesk_domain>/admin/`. This can also be achieved by updating the Ingress `ums-keycloak-extensions-proxy` with an additional path that allows access to `/admin/`.
+
+The admin console login is using the default Keycloak admin account `kcadmin` and the password from the secret `ums-opendesk-keycloak-credentials`.

docs/developer/ci.md

@@ -16,7 +16,7 @@ This page covers openDesk deployment automation via Gitlab CI.
 
 The project includes a `.gitlab-ci.yml` that allows you to execute the deployment from a GitLab instance of your choice.
 
-When starting the pipeline through the GitLab UI, you will be queried for some variables plus the following ones:
+When starting the pipeline through the GitLab UI, you will be queried for some variables, including the following:
 
 - `DOMAIN`: The primary domain for your deployment, making the openDesk services available, e.g., as `https://portal.DOMAIN`.
 - `MAIL_DOMAIN` (optional): The domain for the users' email addresses; it defaults to `DOMAIN`.
@@ -24,7 +24,7 @@ When starting the pipeline through the GitLab UI, you will be queried for some v
 - `NAMESPACE`: Namespace of your K8s cluster openDesk will be installed.
 - `MASTER_PASSWORD_WEB_VAR`: Overwrites value of `MASTER_PASSWORD`.
 
-You might want to set credential variables in the GitLab project at `Settings` > `CI/CD` > `Variables`.
+You might want to set credential variables in the GitLab project at `Settings` > `CI/CD` > `Variables`, the values of which can then be hidden from output logs.
 
 # Tests
 
@@ -32,8 +32,8 @@ The GitLab CI pipeline contains a job named `run-tests` that can trigger a test
 For the trigger to work, the variable `TESTS_PROJECT_URL` has to be set on this GitLab project's CI variables,
 which can be found at `Settings` -> `CI/CD` -> `Variables`. The variable should have this format:
 `<domain of gitlab>/api/v4/projects/<id>`.
-To select the current test set, use the variable `TESTS_TESTSET`. Default: `Smoke`.
+To select the current test suite, use the variable `TESTS_TESTSET`. Default: `Smoke`.
 If the branch of the test pipeline is not `main`, this can be set with the `.gitlab-ci.yml` variable
 `TESTS_BRANCH` while creating a new pipeline.
 
-The variable `testprofile` within the job is set to `Namespace`, which tells the e2e tests to use environment-specific settings that will be read from the cluster and namespace-specific file to be found in the project internal `opendesk-env` repository.
+The variable `testprofile` within the job is set to `Namespace`, which tells the e2e tests to use environment-specific settings that will be read from the cluster and namespace-specific file which is found in the project internal `opendesk-env` repository.

docs/developer/development.md

@@ -6,7 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>Developing openDesk deployment automation</h1>
 
-Active development on the deployment is currently only available for project members.
+Active development on the deployment is currently only available to project members.
 However, contributions are possible using the [CLA](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/CONTRIBUTING.md?ref_type=heads) process.
 
 <!-- TOC -->
@@ -30,7 +30,7 @@ developing the openDesk platform.
 ```mermaid
 flowchart TD
  J[helmfile.yaml.gotmpl\nor a helmfile outside of this repository]-->A
- J-->K[./helmfile/environemnts/*your_environment*/values.yaml.gotmpl\nor any an environment values file]
+ J-->K[./helmfile/environemnts/*your_environment*/values.yaml.gotmpl\nor another environment values file]
  A[./helmfile_generic.yaml.gotmpl]-->B[./helmfile/apps/*all_configured_apps*/helmfile.yaml.gotmpl\nReferences the relevant app Helm\ncharts using details from 'charts.yaml.gotmpl']
  B-->C[./values-*all_configured_components*.yaml.gotmpl\nValues to template the charts\nwith references to the `images.yaml.gotmpl`]
  A-->D[./helmfile/environments/default/*\nwith just some examples below]
@@ -57,37 +57,32 @@ Before you investigate any app-specific configuration, it is recommended that yo
 
 # Default branch, `develop` and other branches
 
-The `main` branch is configured to be the default branch, as visitors of the project on Open CoDE should see that
+The `main` branch is configured to be the default branch, as visitors to the project on openCode should see that
 branch by default.
 
-Please use the `develop` branch to diverge your branch(es) from. See the [workflow guide](./workflow.md)
+Please use the `develop` branch to diverge your branch(es) from. See the [workflow guide](./docs/developer/workflow.md)
 for more details on naming conventions.
 
-There is a CI bot that automatically creates a merge request once you initially push your branch to Open CoDE.
-Of course, the merge request will target the `develop` branch, be in status `draft`, and you are set as the assignee.
-
-If you do not plan to merge from the branch you have pushed, please close the auto-created MR.
-
 # External artifacts - `charts.yaml.gotmpl` and `images.yaml.gotmpl`
 
-The `charts.yaml.gotmpl` and `images.yaml.gotmpl` files are the central place to reference external artifacts used for the deployment.
+The `charts.yaml.gotmpl` and `images.yaml.gotmpl` files are the central place to reference any external artifacts used for the deployment.
 
 Besides the deployment automation itself, some tools work with the contents of the files:
 
 - **Linting**: Ensures consistency of the file contents for the other tools.
 - **Renovate**: Automatically create MRs that update the components to their latest version.
-- **Mirror**: Mirror artifacts to Open CoDE.
+- **Mirror**: Mirror artifacts to openCode.
 
 Please find details on these tools below.
 
 ## Linting
 
 In the project's CI, there is a step dedicated to lint the two yaml files, as we want them to be in
-- alphabetical order regarding the components and
-- in a logical order regarding the non-commented lines (registry > repository > tag).
+- alphabetical order regarding the components
+- logical order regarding the non-commented lines (registry > repository > tag).
 
 In the linting step, the [openDesk CI CLI](https://gitlab.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli) is used to apply the
-just mentioned sorting, and the result is compared with the unsorted version. If there is a delta, the linting fails, and you can fix it by running the CLI tool locally, verifying and applying the result to your branch.
+aforementioned sorting, and the result is compared with the unsorted version. If there is a delta, the linting fails, and you can fix it by running the CLI tool locally, verifying and applying the result to your branch.
 
 > **Note**<br>
 > Please ensure that in component blocks, you use comments only at the beginning of the block or at its end. Ideally, you stick
@@ -134,17 +129,17 @@ Checks for newer versions of the given artifact and creates an MR containing the
 > **Note:**<br>
 > The mirror is scheduled to run every hour at 42 minutes past the hour.
 
-openDesk strives to make all relevant artifacts available on Open CoDE so there is a mirroring process
-configured to pull artifacts that do not originate from Open CoDE into projects called `*-Mirror` within the
+openDesk strives to make all relevant artifacts available on openCode so there is a mirroring process
+configured to pull artifacts that do not originate from openCode into projects called `*-Mirror` within the
 [openDesk Components section](https://gitlab.opencode.de/bmi/opendesk/components).
 
 The mirror script takes the information on what artifacts to mirror from the annotation inside the two yaml files:
 - `# upstreamRegistry` *required*: To identify the source registry
-- `# upstreamRegistryCredentialId`: *optional*: In case the source registry is not public, the access credentials have to be specified as ENV variables containing the value of this key in their name, so you want to specify that key all uppercase:
-  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_USERNAME`
-  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_PASSWORD`
+- `# upstreamRegistryCredentialId`: *optional*: In case the source registry is not public, the access credentials have to be specified as environment variables and contain the value of this key in their name, so you want to specify the key in uppercase:
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_USERNAME`
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_PASSWORD`
 - `# upstreamRepository` *required*: To identify the source repository
-- `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set, the mirror for the component will be activated. Only tags that match the given regular expression are being mirrored. **Note:** You must use single quotes for this attribute's value if you use backslash leading regex notation like `\d`.
+- `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set, the mirror for the component will be activated. Only tags that match the given regular expression will be mirrored. **Note:** You must use single quotes for this attribute's value if you use backslash leading regex notation like `\d`.
 - `# upstreamMirrorStartFrom` *optional*: Array of numeric values in case you want to mirror only artifacts beginning with a specific version. You must use capturing group
  in `# upstreamMirrorTagFilterRegEx` to identify the single numeric elements of the version within the tag and use per capturing group (left to right) one numeric array
  element here to define the version the mirror should start with.
@@ -163,4 +158,4 @@ for Helm charts.
 
 You may also want to make use of our [standard CI](https://gitlab.opencode.de/bmi/opendesk/tooling/gitlab-config) to
 quickly get Helm charts and container images that are signed, linted, scanned, and released.
-Check out the `.gitlab-ci.yaml` files in the project's [Charts](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts) or [Images](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images) to get an idea how little you need to do yourself.
+Check out the `.gitlab-ci.yaml` files in the project's [Charts](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts) or [Images](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images) to get an idea just how little you need to do by yourself.

docs/developer/workflow.md

@@ -34,29 +34,29 @@ SPDX-License-Identifier: Apache-2.0
 
 # Scope
 
-This document covers the development of a technical release, thereby addressing
-- the development and branching concept for the openDesk deployment automation,
-- the related quality gates and
-- how technical releases are being created.
+This document covers the development of a technical release, thereby addressing:
+- the development and branching concept for the openDesk deployment automation
+- the related quality gates
+- the creation of technical releases
 
 It does not cover additional artifacts that might be related to a functional release.
 
 # Roles and responsibilities
 
-The following section should provide a high-level view of the involved parties in the openDesk context and their responsibilities:
+The following section provides a high-level view of the involved parties in the openDesk context and their responsibilities:
 
 - **Open source product suppliers**
   - Focus areas
     - Development of upstream products
     - Development of integrative functionality relevant to openDesk and others
-    - Providing source code and the artifacts required to install openDesk to Open CoDE
+    - Providing source code and the artifacts required to install openDesk to openCode
   - Hand over to _openDesk platform development_
     - Helm charts
     - Container images
     - Documentation
 - **openDesk platform development**
   - Focus areas
-    - Integration of the supplier's artifacts addressing basic operational needs
+    - Integration of the supplier's artifacts, addressing basic operational needs
     - Implementation of services required (e.g. persistence layer) to develop and test openDesk
     - Implementation of the required quality gates (QG)
     - Ensuring the quality gates are passed
@@ -64,26 +64,26 @@ The following section should provide a high-level view of the involved parties i
     - Deployment automation
 - **Operator**
   - Focus areas
-    - Providing production-grade required services (e.g. persistence layer) to operate openDesk
-    - Rollout, operate and support openDesk
-    - Further develop the deployment automation to meet extended operational requirements, ideally providing these developments upstream to openDesk platform development to adopt them into the standard
-  - The operator can either use a self-operated Kubernetes cluster to deploy openDesk or make use of managed Kubernetes offerings of a **Cloud Provider**.
+    - Provide production-grade services (e.g. persistence layer) to operate openDesk
+    - Rollout, operate, and support openDesk
+    - Further develop the deployment automation to meet extended operational requirements, ideally providing these developments upstream to the openDesk platform development in order to have them included as standard in the future.
+  - The operator can either use a self-operated Kubernetes cluster to deploy openDesk or make use of a managed Kubernetes offering from a **Cloud Provider**
 
 # Deployment automation
 
 The openDesk deployment automation is the core outcome of the platform development process.
 
-The openDesk platform development team created and maintains the deployment automation to allow interested parties to deploy openDesk into their cloud infrastructure with a low entry barrier. The core technology for the automation is [Helm](https://helm.sh/), which is orchestrated using [Helmfile](https://github.com/helmfile/helmfile). Of course, this deployment is also used by the suppliers and the platform team in everyday work.
+The openDesk platform development team created and maintains the deployment automation, which allows interested parties to deploy openDesk onto their cloud infrastructure with a low barrier to entry. The core technology for the automation is [Helm](https://helm.sh/), which is orchestrated using [Helmfile](https://github.com/helmfile/helmfile). Of course, this deployment is also used by the suppliers and the platform team in everyday work.
 
 Please find the deployment automation, including its documentation, in the following project: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk
 
-The automation supports Gitlab CI/CD and local execution, triggering the Helmfile deployment for the whole platform or single applications.
+The automation supports Gitlab CI/CD, local execution, and triggering the Helmfile deployment for the whole platform or single applications.
 
 ## openDesk technical component classes
 
-The below rendering in class diagram notation shows the three component classes openDesk consists of. In each of these:
-- the first section below the name of the class shows the required **characteristics** of each component of the given class and
-- the second section shows the **methods** like linting that must be applied to that class's artifacts.
+The below rendering in [class diagram](https://en.wikipedia.org/wiki/Class_diagram) notation shows the three component classes openDesk consists of. In each of these:
+- the first section below the name of the class shows the required **characteristics** of each component of the given class
+- the second section shows the **methods** like linting that must be applied to that class's artifacts
 
 > **Note**<br>
 > The methods prefixed with '-' are not yet available in `gitlab-config`. You will learn about them later.
@@ -119,9 +119,9 @@ classDiagram
 
 ## Functional vs. service components
 
-The focus of openDesk is to provide an integrated functional productivity platform based on the involved suppliers' functional components (products). These functional components usually rely on specific service components, e.g. database services for persistence. When running openDesk in production, the operator is responsible for providing these services in production-grade. For evaluation and development purposes, the openDesk deployment automation includes these services.
+The focus of openDesk is to provide an integrated and functional productivity platform based on the involved suppliers' functional components (products). These functional components usually rely on specific service components, e.g. database services for persistence. When running openDesk in production, the operator is responsible for providing these production-grade services. For evaluation and development purposes, the openDesk deployment automation includes these services.
 
-Find the list of functional and service components in the [deployment automation's components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/blob/main/docs/components.md).
+Find the list of functional and service components in the [archictecture documentation](./docs/architecture.md).
 
 ## Origins
 
@@ -129,7 +129,7 @@ The openDesk platform consolidates the technical components from various origins
 
 1) *Supplier* for functional components: Provide their upstream product, sometimes including openDesk-specific builds or extensions and product deployment (Helm charts).
 2) *Third-party upstream* for service components: The platform development team tries to use as many community upstream components as possible for the services they have to provide within openDesk.
-3) Platform development* filling the gap: Some suppliers might not provide Helm charts or images for their products that fit the needs of openDesk, and some third-party upstream components are not built to fit into openDesk. In these cases, the platform development team creates its own Helm charts and images.
+3) *Platform development* filling the gap: Some suppliers might not provide Helm charts or images for their products that fit the needs of openDesk, and some third-party upstream components are not built to fit into openDesk. In such cases, the platform development team creates its own Helm charts and images.
 
 ## Reference CI for creating Images and Helm charts (gitlab-config)
 
@@ -139,25 +139,28 @@ For that purpose openDesk provides a [GitLab CI-based reference implementation](
 
 ## Licensing
 
-As a standard, the openDesk platform development team uses [reuse.software](https://reuse.software/) wherever possible to annotate license and copyright.
+As a standard, the openDesk platform development team uses [reuse.software](https://reuse.software/) wherever possible to annotate license and copyright information.
 
 openDesk uses Apache 2.0 as the license for their work. A typical reuse copyright and license header looks like this:
 ```
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ```
-The way to mark the license header as a comment differs between the various file types. Please find matching examples for all types across the [deployment automation repository](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace).
+The way to mark the license header as a comment differs between the various file types. Please find matching examples for all types across the [deployment automation repository](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk).
 
 > **Note**<br>
-> If an `SPDX-FileCopyrightText` already exists, do not replace but add an additional line based on the above example.
+> If a `SPDX-FileCopyrightText` already exists with the copyright owner described above but with a past year (e.g. 2024), please update this copyright header line to cover (up to and including) the current year, e.g. `2024-2025`.
+
+> **Note**<br>
+> If line(s) with `SPDX-FileCopyrightText` containing a different copyright owner exist in the file you are working on, do not replace existing one(s), but rather add another header above these.
 
 ## Development workflow
 
 ### Disclaimer
 
-openDesk consists only of community products, so there is no SLA to receive service updates or backport of critical security fixes. This has two consequences:
+openDesk consists only of community products, so there is no SLA related to service updates or backport of critical security fixes. This has two consequences:
 - In production scenarios, you should replace the community versions of the functional components with supported, SLA-backed paid versions.
-- openDesk aims to update the community components' latest available releases continually; therefore, we have rolling technical releases.
+- openDesk aims to update to the community components' latest available releases continually; therefore, we have rolling technical releases.
 
 ### Workflow
 
@@ -168,18 +171,18 @@ This chapter describes the deployment automation's development workflow. The sup
 The picture below uses Gitflow notation to give an overview of the different types of development flows.
 
 The basic facts for the flow are:
-- When the `develop` branch is merged into `main` a technical release is created (except when the merge commit(s) are of type `chore` or `docs`)
+- When the `develop` branch is merged into `main`, a technical release is created (except when the merge commit(s) are of type `chore` or `docs`).
 - Changes that will be applied to openDesk have to branch off from `develop`; we call these branches *feature* branches.
   - Developers can create sub-branches from their feature branch(es) as needed.
 - When a *feature* branch gets pushed a Merge Request in `Draft` state is automatically created.
 - We know three types of *feature* branches:
-  - `docs`: Doing just documentation changes
-  - `fix`: Maintenance of the openDesk software components and minor configurational changes
-  - `feat`: All changes that do not fall into the two categories above, especially
-    - supplier deliverables and
-    - configurational changes that have a significant impact on openDesk users or require migrations[^1]
-- The *QG* entries in the workflow refer to quality gates that are explained in more detail later
-- All merges into `develop` or `main` require two approvals from the platform development team[^2]. The approvers must ensure that the defined quality gates have been passed successfully.
+  - `docs`: Includes only documentation changes.
+  - `fix`: Maintenance of the openDesk software components and minor configurational changes.
+  - `feat`: All changes that do not fall into the two categories above, especially:
+    - supplier deliverables
+    - configuration changes that have a significant impact on openDesk users or require migrations
+- The *QG* entries in the workflow refer to quality gates that are explained in more detail later.
+- All merges into `develop` or `main` require two approvals from the platform development team[^1]. Those approving must ensure that the defined quality gates have been successfully passed.
 
 ```mermaid
 gitGraph
@@ -235,25 +238,25 @@ The Standard Quality Gate addresses quality assurance steps that should be execu
 1. Linting
    - Blocking
      - Licensing: [reuse](https://github.com/fsfe/reuse-tool)
-     - openDesk specific: Especially `images.yaml.gotmpl` and `charts.yaml.gotmpl`, find more details in [development.md](./development.md).
+     - openDesk specific: Especially `images.yaml.gotmpl` and `charts.yaml.gotmpl`, find more details in [development.md](./docs/developer/development.md).
    - Non-Blocking
      - Security: [Kyverno policy check](../.kyverno) addressing some IT-Grundschutz requirements
      - Formal: Yaml
-1. Deploy the full openDesk stack from scratch:
+2. Deploy the full openDesk stack from scratch:
    - All deployment steps must be successful (green)
    - All tests from the end-to-end test set must be successful
-1. Update deployment[^3] of the full openDesk stack and apply the quality measures from the step #1:
+3. Update deployment of the full openDesk stack and apply the quality measures from the step #1:
    - Deploy the current merge target baseline (`develop` or `main`)
    - Update deploy from your QA branch into the instance from the previous step
-1. No showstopper found regarding
-   - SBOM compliance[^4]
+4. No showstopper found regarding:
+   - SBOM compliance[^2]
    - Malware check
-   - CVE check[^5]
-   - Kubescape scan[^5]
+   - CVE check[^3]
+   - Kubescape scan[^3]
 
 Steps #1 to #3 from above are executed as GitLab CI and documented within GitLab.
 
-Step #4 is focused on security and has not been fully implemented yet. Its main objective is to check for regressions. That step is just the second step of a security check and monitoring chain, as shown below. While some checks can be executed against static artifacts (e.g., container images), others might require an up-and-running instance. These are especially located in the third step below, which has not yet been implemented.
+Step #4 is focused on security and has not been fully implemented yet. Its main objective is to check for regressions. That step is just the second step of a security check and monitoring chain, as shown below. While some checks can be executed against static artifacts (e.g., container images), others might require an up-and-running instance. These are specifically located in the third step below, which has not yet been implemented.
 
 ```mermaid
 flowchart TD
@@ -275,7 +278,7 @@ flowchart TD
 
 #### Branch workflows
 
-This section will explain the workflow for each branch (type) based on the Gitflow picture from above.
+This section will explain the workflow for each branch type based on the Gitflow picture from above.
 
 ##### `main`
 
@@ -295,7 +298,7 @@ Merge points: We are using the [Semantic Release convention](https://github.com/
   - That the SQG was successfully executed upon the to-be merged state - it could be done explicitly or based on a `QA 'nightly develop'`
   - In case of `fix` changes that usually have no test automation, Changes have been verified by a member of the platform development team.
   - That the changes have been reviewed by at least two members of the platform development team, giving their approval on the Merge Request.
-- Merge points (from `docs`, `fix`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the just-named branch types.
+- Merge points (from `docs`, `fix`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the aforementioned branch types.
 
 ##### `docs`
 
@@ -367,23 +370,19 @@ Commit messages must adhere to the [Conventional Commit standard](https://www.co
 Example: `fix(open-xchange): Bump to 8.26 to heal issue with functional mailbox provisioning.`
 
 > **Note**<br>
-> The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) as the release's notes are generated from the messages.
+> The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases) as the release's notes are generated from the messages.
 
 #### Verified commits
 
 We only allow verified commits; please read on about the options you have to make your commits verified:
-- https://docs.gitlab.com/ee/user/project/repository/ssh_signed_commits/
-- https://docs.gitlab.com/ee/user/project/repository/gpg_signed_commits/
-- https://docs.gitlab.com/ee/user/project/repository/x509_signed_commits/
+- https://docs.gitlab.com/user/project/repository/signed_commits/ssh/
+- https://docs.gitlab.com/user/project/repository/signed_commits/gpg/
+- https://docs.gitlab.com/user/project/repository/signed_commits/x509/
 
 # Footnotes
 
-[^1]: Migrations are in general not supported before openDesk hits [technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) v1.0.0
+[^1]: These approval rules are not available in the GitLab Free Tier, which is one of the main reasons why deployment automation is not developed on openCode.
 
-[2]: These approval rules are not available in the Gitlab Free Tier, which is one of the main reasons why deployment automation is not developed on Open CoDE.
+[^2]: The SBOM process is executed asynchronously with the development process and tests the most current technical release from the `main` branch. The process still needs to be fully automated.
 
-[^3]: As long as migrations/upgrade paths are not provided - see also footnote #1 - this step is optional.
-
-[^4]: The SBOM process is executed asynchronously with the development process and tests the most current technical release from the `main` branch. The process still needs to be fully automated.
-
-[^5]: The quality gate needs to be implemented primarily when identifying regressions.
+[^3]: The quality gate needs to be implemented primarily when identifying regressions.

docs/enhanced-configuration.md

@@ -7,7 +7,7 @@ SPDX-License-Identifier: Apache-2.0
 
 # Overview
 
-The following enhanced configuration use cases are described in separate documents.
+The following enhanced configuration use cases are described in their respective documents:
 
 - [Separate mail & Matrix domain](./enhanced-configuration/separate-mail-matrix-domain.md)
 - [Federation with external identity provider](./enhanced-configuration/idp-federation.md)

docs/enhanced-configuration/gitops.md

@@ -25,7 +25,7 @@ This documentation will use Argo CD to explain how to deploy openDesk GitOps-sty
 # ArgoCD
 
 We are continuously improving our Argo CD support, please share you experience with Argo CD deployments e.g. by [creating
-at ticket](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues).
+a ticket](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues).
 
 There are two options to deploy openDesk via Argo CD described in the following sections.
 
@@ -42,19 +42,19 @@ References:
 - [Helmfile CLI documentation](https://helmfile.readthedocs.io/en/latest/#cli-reference)
 - [Generate K8s YAML Manifests for openDesk](https://gitlab.opencode.de/bmi/opendesk/deployment/options/generate-k8s-yaml-manifests)
 
-Afterwards, you can use the resulting manifests within an standard Argo CD workflow.
+Afterwards, you can use the resulting manifests within a standard Argo CD workflow.
 
 > **Note**<br>
-> When creating the Argo CD application based on the resulting manifests you must not use the `Automated Sync Policy`
+> When creating the Argo CD application based on the resulting manifests, you must not use the `Automated Sync Policy`
 > offered by Argo CD, as you have to manually ensure the applications are updated in the required sequence.
 
 ## Option 2: Helmfile plugin
 
-It is possible to deploy openDesk via Argo CD with community developed
+It is possible to deploy openDesk via Argo CD with the community developed
 [Helmfile plugin](https://github.com/travisghansen/argo-cd-helmfile).
 
 You can find an example for this approach in the
 [Argo CD Deployments](https://gitlab.opencode.de/bmi/opendesk/deployment/options/argocd-deploy) repository.
 It contains an example Helm chart (`opendesk-parent`) to create Argo CD Applications via a Helm chart (`opendesk`)
-according to `app of apps pattern` and is using sync waves to ensure to required deployment and update sequence
-for openDesk is met.
+according to `app of apps pattern`. It uses sync waves to ensure the deployment matches requirements and the update sequence
+for openDesk is satisfied.

docs/enhanced-configuration/groupware-migration.md

@@ -17,15 +17,17 @@ SPDX-License-Identifier: Apache-2.0
     * [Add multiple user accounts via CSV file](#add-multiple-user-accounts-via-csv-file)
   * [Start the migration](#start-the-migration)
   * [Monitor migration status](#monitor-migration-status)
+* [Appendix](#appendix)
+  * [Validating master authentication](#validating-master-authentication)
 <!-- TOC -->
 
 Most organizations already have email accounts on various platforms that need to be migrated to openDesk. This document describes the migration from M365 accounts to openDesk using the [audriga Migration Service](https://www.audriga.com) in combination with the master authentication option in openDesk. Other source platforms are also supported, and their migrations work in a similar manner.
 
-The migration can be configured on audriga's self-service website, accessed with most common web browsers (e.g. IE, Firefox, Safari or Chrome). No software needs to be installed on your machine. The service connects to your mailbox similarly to what your email client does. Emails, attachments, folders, and, depending on the source systems, contacts, tasks, notes, and calendar data are being copied to your destination account. See [M365 to OX Migration Guide](https://audriga.com/fileadmin/guides/en/MS365-OX.pdf) for the scope and limitations of the process.
+The migration can be configured on audriga's self-service website, accessed with most common web browsers (e.g. IE, Firefox, Safari or Chrome). No software needs to be installed on your machine. The service connects to your mailbox similarly to what your email client does. Emails, attachments, folders, and, depending on the source systems, contacts, tasks, notes, and calendar data are copied to your destination account. See [M365 to OX Migration Guide](https://audriga.com/fileadmin/guides/en/MS365-OX.pdf) for the scope and limitations of the process.
 
 The data in the source mailbox will not be deleted or altered. To configure a migration, only three simple steps in audriga's self-service portal have to be completed. After the migration has started, its status can be continuously monitored on the website.
 
-It may not be possible to complete especially large or complex migrations with only this guide. If you identify issues related to I/O, bandwidth, timeline constraints, or anything else that makes the migration more complicated than you feel comfortable handling on your own using the self-service, please get in touch with contact [audriga's support](mailto:support@audriga.com).
+It may not be possible to complete especially large or complex migrations with only this guide. If you identify issues related to I/O, bandwidth, time constraints, or anything else that makes the migration more complicated than you are comfortable handling on your own using the self-service, please contact [audriga's support](mailto:support@audriga.com).
 
 # Prerequisites
 
@@ -33,13 +35,13 @@ It may not be possible to complete especially large or complex migrations with o
 
 The following instructions provide information on how to authenticate Microsoft 365 / Exchange Online accounts in the audriga migration service with "modern authentication" using a service account without the need to provide a username and password for each mailbox that will be migrated.
 
-You will have to select an existing user account that will be used as a service account for the migration. You have to register the audriga application and create an M365 email group known only to you as described in the following steps:
+You will have to select an existing user account that will be used as a service account for the migration. You have to register the audriga application and create an M365 email group known only to you, as described in the following steps:
 
 ***1. Select one account to serve as a service account***
 
 Please note that the account that shall serve as the service account requires a Microsoft 365/Exchange online license (mailbox).
 
-> **Notes**<br>
+> **Note**<br>
 > If you want to designate your admin account as a service account, you have to provide the admin with a license.
 
 ***2. Register the audriga app in your tenant***
@@ -49,7 +51,7 @@ To register the audriga app in your tenant, log into your admin account and acce
  https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=3cd27a72-a19e-4945-9715-fc24d940428f&redirect_uri=https://umzug.audriga.com/SMESwitchWebApp/oauth_complete.jsp&scope=https://outlook.office.com/.default
 
 - Accept the App "audriga CloudMovr migration"
-- You will be redirected to an audriga page, which you can close without requiring additional interaction.
+- You will be redirected to an audriga page, which you can close - it does not require additional interaction.
 
 > **Note**<br>
 > The audriga application is created under the "Enterprise application" tab in the AzureAD console.
@@ -70,7 +72,7 @@ In openDesk, you have to have all user accounts with mailboxes pre-defined befor
 
 ## Deploy openDesk with master authentication
 
-With openDesk 1.0 Enterprise, you can set openDesk's email components (OX AppSuite and OX Dovecot) into master authentication mode to run the migration as described in this document using the following two settings for your deployment:
+With openDesk 1.0 Enterprise, you can set openDesk's email components (OX AppSuite and OX Dovecot) to master authentication mode to run the migration as described in this document using the following two settings for your deployment. This is NOT available in openDesk Community deployments:
 
 ```
 secrets:
@@ -82,13 +84,15 @@ functional:
       enabled: true
 ```
 
-1. You must specify the master password referenced in the document's following sections.
+1. You must specify a master password, it will be referenced later in this document.
 2. You need to enable the actual master authentication mode.
 
+To validate the master authentication mode please read the appendix section at the end of the document.
+
 Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppSuite.adminPassword` and need to turn off the migration mode by setting `functional.migration.oxAppSuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.
 
 > **Note**<br>
-> For the changes to take effect, it is sufficient to deploy the `open-xchange` component.
+> For the changes to take effect, it is sufficient to re-deploy the `open-xchange` component alone. But you have to restart the Dovecot Pod(s) manually when switching to/from the master authentication mode for the changes to take effect.
 
 > **Note**<br>
 > While in master authentication mode, regular users cannot log in to the webmail module of openDesk or access the mail using IMAP, as it is not recommended that users interact with the target mail infrastructure during the migration scenario described in this document.
@@ -110,12 +114,12 @@ Configure openDesk as your destination server:
 - Select "Configure provider or server" in the provider selection box of the migration application.
 - In the following dialog, select "Open-Xchange" as protocol.
 - On the tab "IMAP"
-  - For "Mailserver (host name or IP address)" enter your IMAP host, e.g. "webmail.your-opendesk-domain.tld".
-  - If your IMAP server is not running on default port 993, enter your nonstandard IMAP port under Details -> Port.
-  - Press check.
+  - For "Mailserver (host name or IP address)" enter your IMAP host, e.g. "webmail.your-opendesk-domain.tld".
+  - If your IMAP server is not running on default port 993, enter your nonstandard IMAP port under Details -> Port.
+  - Press check.
 - On the tab "Open-Xchange"
-  - Set the hostname of your OX AppSuite installation, e.g. "webmail.your-opendesk-domain.tld".
-  - Press check.
+  - Set the hostname of your OX AppSuite installation, e.g. "webmail.your-opendesk-domain.tld".
+  - Press check.
 - If you receive a green checkmark on both tabs, click "Save". Otherwise, check your settings until you get the green checkmark.
 
 ## Adding accounts
@@ -142,7 +146,7 @@ Click on check to verify the credentials. If the data is correct, a green checkm
 
 After checking and confirming, you can use the same procedure to add further mailboxes.
 
-Alternatively, you can add multiple accounts via CSV upload. Find information in the following.
+Alternatively, you can add multiple accounts via CSV upload. More info on that below.
 
 ### Add multiple user accounts via CSV file
 
@@ -182,3 +186,39 @@ Click on "Details" to get further information about the migration.
 You can access a detailed log for each account by clicking "Protocol" on the right-hand side. Here, you can see detected duplicates or encountered errors (e.g., if emails cannot be transferred due to your provider's size limitations).
 
 You will receive status emails for the migration job's submission and start, as well as when the migration job is finished. The emails are sent to the email address you have entered during the configuration. Those emails include a link to the status website so you can easily track and monitor your migration. Once the migration has been started, you can safely close the status website and shut down your computer; the migration will continue. You can re-open the status website anytime.
+
+# Appendix
+
+## Validating master authentication
+
+Below are details in case you want to verify master authentication for Dovecot and OX AppSuite.
+
+Set a few variables first:
+
+```shell
+export MIG_DOMAIN=your-opendesk-domain.tld
+export MIG_WEBMAIL_HOST=webmail
+export MIG_USERNAME=eva
+export MIG_MASTER_PASSWORD=YourMasterPassword
+export MIG_IMAP_PORT=31123
+```
+
+Ensure that you have defined a (your) default context for the migration where the account (in this example `eva`) can be found. The following should be executed in OX App Suite's `open-xchange-core-mw-default-0` container, in the example we set the default context to `1`:
+
+```shell
+/opt/open-xchange/sbin/changecontext -c 1 -L defaultcontext -A $MASTER_ADMIN_USER -P $MASTER_ADMIN_PW
+```
+
+With the preparation from above you should be able to successfully authenticate to both components:
+
+**OX App Suite**
+
+```shell
+curl -X POST -d "name=${MIG_USERNAME}&password=${MIG_MASTER_PASSWORD}" "https://${MIG_WEBMAIL_HOST}.${MIG_DOMAIN}/appsuite/api/login?action=login"
+```
+
+**Dovecot**
+
+```shell
+echo "a001 LOGIN ${MIG_USERNAME} ${MIG_MASTER_PASSWORD}" | openssl s_client -ign_eof -connect ${MIG_DOMAIN}:${MIG_IMAP_PORT}
+```

docs/enhanced-configuration/idp-federation.md

@@ -20,18 +20,20 @@ SPDX-License-Identifier: Apache-2.0
   * [openDesk IdP](#opendesk-idp)
 <!-- TOC -->
 
-Most organizations already have an Identity and Access Management (IAM) system with an identity provider (IdP) for single sign-on to internal or external web applications.
+Most organizations already have an Identity and Access Management (IAM) system with an identity provider (IdP) for single sign-on (SSO) to internal or external web applications.
 
-This document shows how to configure your organization's IdP and the openDesk IdP to support account federation with openDesk single sign-on based on your organization's login.
+This document explains how to configure your organization's IdP and the openDesk IdP to support account federation with openDesk SSO based on your organization's login.
 
 # References
 
-We would like to list successful IdP federation scenarios, so we are also happy about input from the community:
+We would like to list successful IdP federation scenarios:
 
-| External IdP                                                        | last openDesk version tested |
-| ------------------------------------------------------------------- | ---------------------------- |
-| [EU Login](https://webgate.ec.europa.eu/cas/userdata/myAccount.cgi) | v0.9.0                       |
-| [ProConnect](https://www.proconnect.gouv.fr/)                       | v0.9.0                       |
+| External IdP                                                        | openDesk versions tested |
+|---------------------------------------------------------------------|--------------------------|
+| [EU Login](https://webgate.ec.europa.eu/cas/userdata/myAccount.cgi) | v0.9.0, v1.2.0           |
+| [ProConnect](https://www.proconnect.gouv.fr/)                       | v0.9.0                   |
+
+>If you have successfully federated using another External IdP, please let us know so we can update the list above.
 
 # Prerequisites
 
@@ -58,7 +60,7 @@ In addition to the configuration, it is required that user accounts with the sam
   - This feature is currently unavailable in openDesk's Keycloak, but Univention plans to make it available in the future.
   - Ad-hoc provisioning creates a user account on the fly during a user's first login.
   - While ad-hoc provisioning is an excellent approach for a quick start with openDesk, it has various downsides:
-    - Users are created after their first login, so you cannot find your colleagues in the openDesk apps unless they have already logged in.
+    - Users are created after their first login, so you cannot find your colleagues in the openDesk apps unless they have already logged in once.
     - A user account would never be deactivated or deleted in openDesk.
     - Group memberships are not transferred.
 
@@ -70,7 +72,7 @@ This document focuses on the OIDC federation between an external IdP and the ope
 
 ## Versions
 
-The example was tested with openDesk v0.7.0 using its integrated Keycloak v24.0.3. As external IdP, we also used an openDesk deployment of the same version but created a separate realm for proper configuration separation.
+The example was tested with openDesk v0.7.0 using its integrated Keycloak v24.0.3. As external IdP, we also used an openDesk deployment of the same version, but created a separate realm for proper configuration separation.
 
 ## Example values
 
@@ -80,12 +82,12 @@ The following values are used in this example documentation. Please ensure when
 - `id.opendesk.tld`: hostname for the openDesk IdP, so openDesk is deployed at `opendesk.tld`.
 - `fed-test-idp-realm`: realm name for your organization's IdP.
 - `opendesk-federation-client`: OIDC client for the openDesk federation defined in your organization's IdP.
-- `auto-federate-idp`: Identifier of your organization IdP's configuration within the openDesk Keycloak.
-- `auto-federate-flow`: Identifier of the required additional login flow to be created and referenced in the openDesk Keycloak.
+- `sso-federation-idp`: Identifier of your organization IdP's configuration within the openDesk Keycloak.
+- `sso-federation-flow`: Identifier of the required additional login flow to be created and referenced in the openDesk Keycloak.
 
 ## Keycloak admin console access
 
-To access Keycloak's admin console in an openDesk deployment, you must add a route for `/admin` to the Keycloak's ingress. This is done automatically if you deploy openDesk with `debug.enabled: true`, but beware that this will also cause a lot of log output across all openDesk pods.
+To access the Keycloak admin console in an openDesk deployment, you must add a route for `/admin` to the Keycloak ingress. This is done automatically if you deploy openDesk with `debug.enabled: true`, but beware that this will also cause a lot of log output across all openDesk pods.
 
 The admin console will be available at:
 - Organization's IdP: https://idp.organization.tld/admin/master/console/
@@ -97,7 +99,7 @@ For the following configuration steps, log in with user `kcadmin` and grab the p
 
 In this example, we use the Keycloak of another openDesk instance to simulate your organization's IdP. However, URL paths differ if you use another product.
 
-Please let us know about your experiences or differences you came across.
+Please let us know about your experiences or any differences you encountered.
 
 ### Separate realm
 
@@ -115,7 +117,7 @@ If you just created the `fed-test-idp-realm`, you are already in the admin scree
   - Client create wizard page 1:
     - *Client type*: `OpenID Connect`
     - *Client-ID*: `opendesk-federation-client`
-    - *Name*: `openDesk @ your organization` (is the descriptive text of the client that might show up in your IdP's UI and therefore should explain what the client is used for)
+    - *Name*: `openDesk @ your organization` (this is the descriptive text of the client that might show up in your IdP's UI and therefore should explain what the client is used for)
   - Client create wizard page 2:
     - *Client authentication*: `On`
     - *Authorization*: `Off` (default)
@@ -123,8 +125,8 @@ If you just created the `fed-test-idp-realm`, you are already in the admin scree
       - `Standard flow`
       - `Direct access grants`
   - Client create wizard page 3:
-    - *Valid Redirect URLs*: `https://id.opendesk.tld/realms/opendesk/broker/auto-federate-idp/endpoint`
-  - When completed with *Save*, you get to the detailed client configured that also needs some updates:
+    - *Valid Redirect URLs*: `https://id.opendesk.tld/realms/opendesk/broker/sso-federation-idp/endpoint`
+  - When completed with *Save*, you get to the detailed client configuration that also needs some updates:
     - Tab *Settings* > Section *Logout settings*
       - *Front channel logout*: `Off`
       - *Back channel logout URL*: `https://id.opendesk.tld/realms/opendesk/protocol/openid-connect/logout/backchannel-logout`
@@ -133,17 +135,21 @@ If you just created the `fed-test-idp-realm`, you are already in the admin scree
 
 ## openDesk IdP
 
+> **Note**
+> While manual configuration is possible, an SSO federation can also be configured as part of the deployment.
+> Check `functional.authentication.ssoFederation` section from the `functional.yaml.gotmpl` for details.
+
 The following configuration is taking place in the Keycloak realm `opendesk`.
 
 - *Authentication* > *Create flow*
-  - *Name*: `auto-federate-flow`
+  - *Name*: `sso-federation-flow`
   - *Flow type*: `Basic flow`
   - *Create*
   - *Add execution*: Add `Detect existing broker user` and set it to `Required`
   - *Add step*: `Automatically set existing user` and set it to `Required`
 
 - *Identity providers* > *User-defined* > *OpenID Connect 1.0*
-  - *Alias*: `auto-federate-idp` (used in our example)
+  - *Alias*: `sso-federation-idp` (used in our example)
   - *Display Name*: A descriptive Name, in case you do not forcefully redirect the user to the IdP, that name is shown on the login screen for manual selection.
   - *Use discovery endpoint*: `On` (default)
   - *Discovery endpoint*: `https://idp.organization.tld/realms/fed-test-idp-realm/.well-known/openid-configuration` - this URL may look different if you do not use Keycloak or a different Keycloak version as IdP in your organization
@@ -152,12 +158,12 @@ The following configuration is taking place in the Keycloak realm `opendesk`.
   - *Client authentication*: `Client secret sent as post` (default)
   - *Client ID*: Use the client ID you took from your organization's IdP config (`opendesk-federation-client` in this example)
   - *Client Secret*: Use the secret you took from your organization's IdP config
-  - When completed with *Add*, you get to the detailed IdP configuration that at least needs some the following update:
-    - *First login flow override*: `auto-federate-flow`
-    - Depending on your organizations IdP and process preferences additional setting may be required
+  - When completed with *Add*, you get to the detailed IdP configuration which at least needs the following update:
+    - *First login flow override*: `sso-federation-flow`
+    - Depending on your organizations IdP and process preferences, additional configuration may be required
 
 - In case you want to forcefully redirect all users to your organization's IdP (disabling login with local openDesk accounts):
   - *Authentication* > `2fa-browser`
     - Click on the cogwheel next to the *Identity Provider Re-director*
-      - *Alias*: `auto-federate-idp`
-      - *Default Identity Provider*: `auto-federate-idp`
+      - *Alias*: `sso-federation-idp`
+      - *Default Identity Provider*: `sso-federation-idp`

docs/enhanced-configuration/matrix-federation.md

@@ -6,14 +6,13 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Matrix federation</h1>
 
 <!-- TOC -->
-* [Context](#context)
 * [Example configuration](#example-configuration)
   * [Disable federation](#disable-federation)
   * [Separate Matrix domain](#separate-matrix-domain)
 <!-- TOC -->
 
 The Element chat application and its server component Synapse are based on the Matrix protocol,
-that supports federation with other Matrix servers to communicate with the users with accounts on these servers.
+which supports federation with other Matrix servers, allowing communication with the users with accounts on these servers.
 
 By default, you can chat with users who have an account within your openDesk installation and federate with other
 matrix-based servers.
@@ -36,15 +35,15 @@ The following setting can turn off federation:
 
 ```yaml
 functional:
-  externalServices:
-    matrix:
-      federation:
-        enabled: false
+  externalServices:
+    matrix:
+      federation:
+        enabled: false
 ```
 
 ## Separate Matrix domain
 
-If you want to federate with other Matrix instances and use a separate Matrix domain, you need to provide a JSON file on
+If you want to federate with other Matrix instances and use a separate Matrix domain, you need to provide a JSON file for
 the Matrix domain to use delegation. It is not part of your openDesk deployment.
 
 Domain path: `https://my_organization.tld/.well-known/matrix/server`
@@ -52,9 +51,9 @@ Domain path: `https://my_organization.tld/.well-known/matrix/server`
 Content:
 ```JSON
 {
-    "m.server": "matrix-federation.opendesk.domain.tld:443"
+    "m.server": "matrix-federation.opendesk.domain.tld:443"
 }
 ```
 
-More detailed information can be found in Matrix/Synapse documentation:
+More detailed information can be found in the Matrix/Synapse documentation:
 [Matrix Delegation](https://element-hq.github.io/synapse/latest/delegate.html)

docs/enhanced-configuration/self-signed-certificates.md

@@ -3,25 +3,27 @@ SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlic
 SPDX-License-Identifier: Apache-2.0
 -->
 
-<h1>Self-signed certificate and custom Certificate Authority (CA)</h1>
+<h1>Self-signed certificates and custom Certificate Authority (CA)</h1>
 
 <!-- TOC -->
 * [Configuration](#configuration)
   * [Option 1: Bring Your Own Certificate](#option-1-bring-your-own-certificate)
   * [Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate](#option-2a-use-cert-managerio-with-auto-generated-namespace-based-root-certificate)
-  * [Option 2b: Use cert-manager.io with pre-defined/shared root-certificate](#option-2b-use-cert-managerio-with-pre-definedshared-root-certificate)
+  * [Option 2b: Use cert-manager.io with a pre-defined or shared root-certificate](#option-2b-use-cert-managerio-with-a-pre-defined-or-shared-root-certificate)
 <!-- TOC -->
 
-Deploying openDesk into an environment with custom public key infrastructure (PKI) that is usually not part of
-public certificate authority chains or deploying openDesk into a local cluster without ACME challenge.
+This document covers:
+* Deploying openDesk into an environment with custom public key infrastructure (PKI) that is usually not part of
+public certificate authority chains
+* deploying openDesk into a local cluster without ACME challenge
 
 # Configuration
 
-There are two options to address the use case.
+There are two options to address these use case:
 
 ## Option 1: Bring Your Own Certificate
 
-This option is useful, when you have your own PKI in your environment which is trusted by all clients that should
+This option is useful when you have your own PKI in your environment which is also trusted by all clients that should
 access openDesk.
 
 1. Disable cert-manager.io certificate resource creation:
@@ -31,26 +33,26 @@ access openDesk.
       enabled: false
     ```
 
-1. Enable mount of self-signed certificates:
+2. Enable mount of self-signed certificates:
 
     ```yaml
     certificate:
       selfSigned: true
     ```
 
-1. Create a Kubernetes secret named `opendesk-certificates-tls` of type `kubernetes.io/tls` containing either a valid
+3. Create a Kubernetes secret named `opendesk-certificates-tls` of type `kubernetes.io/tls` containing either a valid
 wildcard certificate or a certificate with [all required subdomains](../../helmfile/environments/default/global.yaml.gotmpl)
 set as SANs (Subject Alternative Name).
 
-1. Create a Kubernetes secret with name `opendesk-certificates-ca-tls` of type `kubernetes.io/tls` containing the custom
+4. Create a Kubernetes secret with name `opendesk-certificates-ca-tls` of type `kubernetes.io/tls` containing the custom
 CA certificate as X.509 encoded (`ca.crt`) and as jks trust store (`truststore.jks`).
 
-1. Create a Kubernetes secret with name `opendesk-certificates-keystore-jks` with key `password` and as value the jks
+5. Create a Kubernetes secret with name `opendesk-certificates-keystore-jks` with key `password` and as value the jks
 trust store password.
 
 ## Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate
 
-This option is useful, when you do not have a trusted certificate available and can't fetch a certificate from
+This option is useful when you do not have a trusted certificate available and can't fetch a certificate from
 Let’s Encrypt. It will result in a cert-manager managed root certificate in the namespace you deploy openDesk into.
 
 1. Create self-signed cert-manager.io Cluster Issuer:
@@ -63,7 +65,7 @@ Let’s Encrypt. It will result in a cert-manager managed root certificate in th
       selfSigned: {}
     ```
 
-1. Enable mount and creation of self-signed certificates:
+2. Enable mount and creation of self-signed certificates:
     ```yaml
     certificate:
       issuerRef:
@@ -71,14 +73,14 @@ Let’s Encrypt. It will result in a cert-manager managed root certificate in th
       selfSigned: true
     ```
 
-## Option 2b: Use cert-manager.io with pre-defined/shared root-certificate
+## Option 2b: Use cert-manager.io with a pre-defined or shared root-certificate
 
 Use this approach if you like to use a pre-created CA root certificate that can be "shared" (as copy) between
 multiple namespaces in a cluster.
 
-1. Create self-signed cert-manager.io Cluster Issuer root certificate the same was as in *Option 2a*.
+1. Create self-signed cert-manager.io Cluster Issuer root certificate the same way as in *Option 2a*.
 
-1. Create the root certificate for the previously created CA, in the example it is placed into the namespace `cert-manager`.
+2. Create the root certificate for the previously created CA, in the example it is placed into the namespace `cert-manager`.
     ```yaml
     apiVersion: cert-manager.io/v1
     kind: Certificate
@@ -98,10 +100,12 @@ multiple namespaces in a cluster.
         name: selfsigned-issuer
         kind: ClusterIssuer
         group: cert-manager.io
+      duration: 87600h # 10y
+      renewBefore: 87599h
     ```
 
-1. Copy this cert's secret into the/each namespace you want to make use of the cert.
+3. Copy this certificates secret into all namespaces you want to make use of the certificate in.
 
-1. Create issuer in the/each namespace you want to make use of the cert.
+4. Create an issuer resource in all namespaces you want to make use of the certificate in.
 
-The latter two steps are part of the `env-start:` section within [`.gitlab-ci.yml`](../../.gitlab-ci.yml).
+>The latter two steps are part of the `env-start:` section within [`.gitlab-ci.yml`](../../.gitlab-ci.yml).

docs/enhanced-configuration/separate-mail-matrix-domain.md

@@ -6,7 +6,6 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Separate domains for mail and or Matrix </h1>
 
 <!-- TOC -->
-* [Context](#context)
 * [Example configuration](#example-configuration)
   * [Mail domain](#mail-domain)
   * [Matrix domain](#matrix-domain)

docs/external-services.md

@@ -20,87 +20,101 @@ When deploying this suite to production, you need to configure the applications
 service.
 
 > **Note**<br>
-> openDesk supports PostgreSQL as alternative database backend for Nextcloud and XWiki. PostgreSQL is likely become the preferred option/default in the future and MariaDB might be deprecated at a later point requiring migrations[^1] if you do not select PostgreSQL for new installations.
+> openDesk supports PostgreSQL as alternative database backend for Nextcloud and XWiki. PostgreSQL is likely to become the preferred option/default in the future should MariaDB become deprecated. This would cause migration[^1] to be necessary if you do not select PostgreSQL for new installations.
 
-| Component        | Name               | Parameter | Key                                           | Default                      |
-| ---------------- | ------------------ | --------- | --------------------------------------------- | ---------------------------- |
-| Element          | Synapse            |           |                                               |                              |
-|                  |                    | Type      | `databases.synapse.type`                      | `postgresql`                 |
-|                  |                    | Name      | `databases.synapse.name`                      | `matrix`                     |
-|                  |                    | Host      | `databases.synapse.host`                      | `postgresql`                 |
-|                  |                    | Port      | `databases.synapse.port`                      | `5432`                       |
-|                  |                    | Username  | `databases.synapse.username`                  | `matrix_user`                |
-|                  |                    | Password  | `databases.synapse.password`                  |                              |
-| Nubus            | Guardian Mgmt API  |           |                                               |                              |
-|                  |                    | Type      | `databases.umsGuardianManagementApi.type`     | `postgresql`                 |
-|                  |                    | Name      | `databases.umsGuardianManagementApi.name`     | `guardianmanagementapi`      |
-|                  |                    | Host      | `databases.umsGuardianManagementApi.host`     | `postgresql`                 |
-|                  |                    | Port      | `databases.umsGuardianManagementApi.port`     | `5432`                       |
-|                  |                    | Username  | `databases.umsGuardianManagementApi.username` | `guardianmanagementapi_user` |
-|                  |                    | Password  | `databases.umsGuardianManagementApi.password` |                              |
-|                  | Keycloak           |           |                                               |                              |
-|                  |                    | Type      | `databases.keycloak.type`                     | `postgresql`                 |
-|                  |                    | Name      | `databases.keycloak.name`                     | `keycloak`                   |
-|                  |                    | Host      | `databases.keycloak.host`                     | `postgresql`                 |
-|                  |                    | Port      | `databases.keycloak.port`                     | `5432`                       |
-|                  |                    | Username  | `databases.keycloak.username`                 | `keycloak_user`              |
-|                  |                    | Password  | `databases.keycloak.password`                 |                              |
-|                  | Keycloak Extension |           |                                               |                              |
-|                  |                    | Type      | `databases.keycloakExtension.type`            | `postgresql`                 |
-|                  |                    | Name      | `databases.keycloakExtension.name`            | `keycloak_extensions`        |
-|                  |                    | Host      | `databases.keycloakExtension.host`            | `postgresql`                 |
-|                  |                    | Port      | `databases.keycloakExtension.port`            | `5432`                       |
-|                  |                    | Username  | `databases.keycloakExtension.username`        | `keycloak_extensions_user`   |
-|                  |                    | Password  | `databases.keycloakExtension.password`        |                              |
-|                  | Notifications API  |           |                                               |                              |
-|                  |                    | Type      | `databases.umsNotificationsApi.type`          | `postgresql`                 |
-|                  |                    | Name      | `databases.umsNotificationsApi.name`          | `notificationsapi`           |
-|                  |                    | Host      | `databases.umsNotificationsApi.host`          | `postgresql`                 |
-|                  |                    | Port      | `databases.umsNotificationsApi.port`          | `5432`                       |
-|                  |                    | Username  | `databases.umsNotificationsApi.username`      | `notificationsapi_user`      |
-|                  |                    | Password  | `databases.umsNotificationsApi.password`      |                              |
-|                  | Self Service       |           |                                               |                              |
-|                  |                    | Type      | `databases.umsSelfservice.type`               | `postgresql`                 |
-|                  |                    | Name      | `databases.umsSelfservice.name`               | `selfservice`                |
-|                  |                    | Host      | `databases.umsSelfservice.host`               | `postgresql`                 |
-|                  |                    | Port      | `databases.umsSelfservice.port`               | `5432`                       |
-|                  |                    | Username  | `databases.umsSelfservice.username`           | `selfservice_user`           |
-|                  |                    | Password  | `databases.umsSelfservice.password`           |                              |
-| Nextcloud        | Nextcloud          |           |                                               |                              |
-|                  |                    | Type      | `databases.nextcloud.type`                    | `mariadb`                    |
-|                  |                    | Name      | `databases.nextcloud.name`                    | `nextcloud`                  |
-|                  |                    | Host      | `databases.nextcloud.host`                    | `mariadb`                    |
-|                  |                    | Port      | `databases.nextcloud.port`                    | `3306`                       |
-|                  |                    | Username  | `databases.nextcloud.username`                | `nextcloud_user`             |
-|                  |                    | Password  | `databases.nextcloud.password`                |                              |
-| Notes            | Notes              |           |                                               |                              |
-|                  |                    | Type      | `databases.notes.type`                        | `postgresql`                 |
-|                  |                    | Name      | `databases.notes.name`                        | `notes`                      |
-|                  |                    | Host      | `databases.notes.host`                        | `postgresql`                 |
-|                  |                    | Port      | `databases.notes.port`                        | `5432`                       |
-|                  |                    | Username  | `databases.notes.username`                    | `notes_user`                 |
-|                  |                    | Password  | `databases.notes.password`                    |                              |
-| OpenProject      | OpenProject        |           |                                               |                              |
-|                  |                    | Type      | `databases.openproject.type`                  | `postgresql`                 |
-|                  |                    | Name      | `databases.openproject.name`                  | `openproject`                |
-|                  |                    | Host      | `databases.openproject.host`                  | `postgresql`                 |
-|                  |                    | Port      | `databases.openproject.port`                  | `5432`                       |
-|                  |                    | Username  | `databases.openproject.username`              | `openproject_user`           |
-|                  |                    | Password  | `databases.openproject.password`              |                              |
-| OX App Suite[^2] | OX App Suite       |           |                                               |                              |
-|                  |                    | Type      | `databases.oxAppSuite.type`                   | `mariadb`                    |
-|                  |                    | Name      | `databases.oxAppSuite.name`                   | `openxchange`                |
-|                  |                    | Host      | `databases.oxAppSuite.host`                   | `mariadb`                    |
-|                  |                    | Port      | `databases.oxAppSuite.port`                   | `3306`                       |
-|                  |                    | Username  | `databases.oxAppSuite.username`               | `root`                       |
-|                  |                    | Password  | `databases.oxAppSuite.password`               |                              |
-| XWiki[^3]        | XWiki              |           |                                               |                              |
-|                  |                    | Type      | `databases.xwiki.type`                        | `mariadb`                    |
-|                  |                    | Name      | `databases.xwiki.name`                        | `xwiki`                      |
-|                  |                    | Host      | `databases.xwiki.host`                        | `mariadb`                    |
-|                  |                    | Port      | `databases.xwiki.port`                        | `3306`                       |
-|                  |                    | Username  | `databases.xwiki.username`                    | `root`                       |
-|                  |                    | Password  | `databases.xwiki.password`                    |                              |
+| Component          | Name               | Parameter | Key                                           | Default                      |
+| ------------------ | ------------------ | --------- | --------------------------------------------- | ---------------------------- |
+| Element            | Synapse            |           |                                               |                              |
+|                    |                    | Type      | `databases.synapse.type`                      | `postgresql`                 |
+|                    |                    | Name      | `databases.synapse.name`                      | `matrix`                     |
+|                    |                    | Host      | `databases.synapse.host`                      | `postgresql`                 |
+|                    |                    | Port      | `databases.synapse.port`                      | `5432`                       |
+|                    |                    | Username  | `databases.synapse.username`                  | `matrix_user`                |
+|                    |                    | Password  | `databases.synapse.password`                  |                              |
+| Nubus              | Guardian Mgmt API  |           |                                               |                              |
+|                    |                    | Type      | `databases.umsGuardianManagementApi.type`     | `postgresql`                 |
+|                    |                    | Name      | `databases.umsGuardianManagementApi.name`     | `guardianmanagementapi`      |
+|                    |                    | Host      | `databases.umsGuardianManagementApi.host`     | `postgresql`                 |
+|                    |                    | Port      | `databases.umsGuardianManagementApi.port`     | `5432`                       |
+|                    |                    | Username  | `databases.umsGuardianManagementApi.username` | `guardianmanagementapi_user` |
+|                    |                    | Password  | `databases.umsGuardianManagementApi.password` |                              |
+|                    | Keycloak           |           |                                               |                              |
+|                    |                    | Type      | `databases.keycloak.type`                     | `postgresql`                 |
+|                    |                    | Name      | `databases.keycloak.name`                     | `keycloak`                   |
+|                    |                    | Host      | `databases.keycloak.host`                     | `postgresql`                 |
+|                    |                    | Port      | `databases.keycloak.port`                     | `5432`                       |
+|                    |                    | Username  | `databases.keycloak.username`                 | `keycloak_user`              |
+|                    |                    | Password  | `databases.keycloak.password`                 |                              |
+|                    | Keycloak Extension |           |                                               |                              |
+|                    |                    | Type      | `databases.keycloakExtension.type`            | `postgresql`                 |
+|                    |                    | Name      | `databases.keycloakExtension.name`            | `keycloak_extensions`        |
+|                    |                    | Host      | `databases.keycloakExtension.host`            | `postgresql`                 |
+|                    |                    | Port      | `databases.keycloakExtension.port`            | `5432`                       |
+|                    |                    | Username  | `databases.keycloakExtension.username`        | `keycloak_extensions_user`   |
+|                    |                    | Password  | `databases.keycloakExtension.password`        |                              |
+|                    | Notifications API  |           |                                               |                              |
+|                    |                    | Type      | `databases.umsNotificationsApi.type`          | `postgresql`                 |
+|                    |                    | Name      | `databases.umsNotificationsApi.name`          | `notificationsapi`           |
+|                    |                    | Host      | `databases.umsNotificationsApi.host`          | `postgresql`                 |
+|                    |                    | Port      | `databases.umsNotificationsApi.port`          | `5432`                       |
+|                    |                    | Username  | `databases.umsNotificationsApi.username`      | `notificationsapi_user`      |
+|                    |                    | Password  | `databases.umsNotificationsApi.password`      |                              |
+|                    | Self Service       |           |                                               |                              |
+|                    |                    | Type      | `databases.umsSelfservice.type`               | `postgresql`                 |
+|                    |                    | Name      | `databases.umsSelfservice.name`               | `selfservice`                |
+|                    |                    | Host      | `databases.umsSelfservice.host`               | `postgresql`                 |
+|                    |                    | Port      | `databases.umsSelfservice.port`               | `5432`                       |
+|                    |                    | Username  | `databases.umsSelfservice.username`           | `selfservice_user`           |
+|                    |                    | Password  | `databases.umsSelfservice.password`           |                              |
+| Nextcloud          | Nextcloud          |           |                                               |                              |
+|                    |                    | Type      | `databases.nextcloud.type`                    | `postgresql`                 |
+|                    |                    | Name      | `databases.nextcloud.name`                    | `nextcloud`                  |
+|                    |                    | Host      | `databases.nextcloud.host`                    | `postgresql`                 |
+|                    |                    | Port      | `databases.nextcloud.port`                    | `5432`                       |
+|                    |                    | Username  | `databases.nextcloud.username`                | `nextcloud_user`             |
+|                    |                    | Password  | `databases.nextcloud.password`                |                              |
+| Notes              | Notes              |           |                                               |                              |
+|                    |                    | Type      | `databases.notes.type`                        | `postgresql`                 |
+|                    |                    | Name      | `databases.notes.name`                        | `notes`                      |
+|                    |                    | Host      | `databases.notes.host`                        | `postgresql`                 |
+|                    |                    | Port      | `databases.notes.port`                        | `5432`                       |
+|                    |                    | Username  | `databases.notes.username`                    | `notes_user`                 |
+|                    |                    | Password  | `databases.notes.password`                    |                              |
+| OpenProject        | OpenProject        |           |                                               |                              |
+|                    |                    | Type      | `databases.openproject.type`                  | `postgresql`                 |
+|                    |                    | Name      | `databases.openproject.name`                  | `openproject`                |
+|                    |                    | Host      | `databases.openproject.host`                  | `postgresql`                 |
+|                    |                    | Port      | `databases.openproject.port`                  | `5432`                       |
+|                    |                    | Username  | `databases.openproject.username`              | `openproject_user`           |
+|                    |                    | Password  | `databases.openproject.password`              |                              |
+| OX App Suite[^2]   | OX App Suite       |           |                                               |                              |
+|                    |                    | Type      | `databases.oxAppSuite.type`                   | `mariadb`                    |
+|                    |                    | Name      | `databases.oxAppSuite.name`                   | `openxchange`                |
+|                    |                    | Host      | `databases.oxAppSuite.host`                   | `mariadb`                    |
+|                    |                    | Port      | `databases.oxAppSuite.port`                   | `3306`                       |
+|                    |                    | Username  | `databases.oxAppSuite.username`               | `root`                       |
+|                    |                    | Password  | `databases.oxAppSuite.password`               |                              |
+| OX Dovecot Pro[^3] | ACLs               |           |                                               |                              |
+|                    |                    | Type      | `databases.dovecotACL.type`                   | `cassandra`                  |
+|                    |                    | Name      | `databases.dovecotACL.name`                   | `dovecot_acl`                |
+|                    |                    | Host      | `databases.dovecotACL.host`                   | `cassandra`                  |
+|                    |                    | Port      | `databases.dovecotACL.port`                   | `9042`                       |
+|                    |                    | Username  | `databases.dovecotACL.username`               | `dovecot_acl_user`           |
+|                    |                    | Password  | `databases.dovecotACL.password`               |                              |
+|                    | Dictmap            |           |                                               |                              |
+|                    |                    | Type      | `databases.dovecotDictmap.type`               | `cassandra`                  |
+|                    |                    | Name      | `databases.dovecotDictmap.name`               | `dovecot_dictmap`            |
+|                    |                    | Host      | `databases.dovecotDictmap.host`               | `cassandra`                  |
+|                    |                    | Port      | `databases.dovecotDictmap.port`               | `9042`                       |
+|                    |                    | Username  | `databases.dovecotDictmap.username`           | `dovecot_dictmap_user`       |
+|                    |                    | Password  | `databases.dovecotDictmap.password`           |                              |
+| XWiki[^4]          | XWiki              |           |                                               |                              |
+|                    |                    | Type      | `databases.xwiki.type`                        | `postgresql`                 |
+|                    |                    | Name      | `databases.xwiki.name`                        | `xwiki`                      |
+|                    |                    | Host      | `databases.xwiki.host`                        | `postgresql`                 |
+|                    |                    | Port      | `databases.xwiki.port`                        | `5432`                       |
+|                    |                    | Username  | `databases.xwiki.username`                    | `xwiki_user`                 |
+|                    |                    | Password  | `databases.xwiki.password`                    |                              |
 
 # Object storage
 
@@ -141,7 +155,7 @@ service.
 
 # Footnotes
 
-[^1] The upstream product provide some valuable information regarding database migrations:
+[^1] The upstream product documentation provides some valuable information regarding database migrations:
 - Nextcloud: https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/db_conversion.html
 - XWiki:
   - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Backup#HUsingtheXWikiExportfeature
@@ -149,4 +163,6 @@ service.
 
 [^2] OX App Suite only supports MariaDB and requires root access, as it manages its databases itself.
 
-[^3] XWiki requires root access when using MariaDB as sub-wikis are using separate databases that are managed by XWiki. When using PostgreSQL with XWiki no root user is required as the sub-wikis are managed within multiple schemes within a single database.
+[^3] openDesk Enterprise only.
+
+[^4] XWiki requires root access when using MariaDB due to the fact that sub-wikis use separate databases that are managed by XWiki. When using PostgreSQL with XWiki no root user is required as the sub-wikis are managed within multiple schemas within a single database.

docs/functional.md

@@ -0,0 +1,35 @@
+<!--
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Functional configuration</h1>
+
+This document addresses the available functional configuration options of an openDesk deployment.
+
+<!-- TOC -->
+* [Supported functional configuration](#supported-functional-configuration)
+* [Customization of functional options](#customization-of-functional-options)
+<!-- TOC -->
+
+## Supported functional configuration
+
+While the openDesk applications allow a wide range of configuration options, only a small subset of them are supported by openDesk. This subset can be found in [`helmfile/environments/default/functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl)
+
+The following categories are available. Each category contains a set of options to tailor your openDesk deployment to your needs. Please find the actual options including inline documentation in [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl) itself.
+
+* Administrative options (`functional.admin.*`): Options affecting the IAM administrator role (users that are member of the LDAP group `Domain Admins`) of openDesk.
+* Authentication options (`functional.authentication.*`): Authentication related settings, e.g. define additional [OIDC](https://en.wikipedia.org/wiki/OpenID#OpenID_Connect_(OIDC)) clients or scopes.
+* External Services options (`functional.externalServices.*`): Settings controlling externally available services like APIs.
+* Filestore options (`functional.filestore.*`): Configuration options for the filestore component of openDesk, like default storage quota or file sharing options.
+* Data Protection options (`functional.dataProtection.*`): Data protection related settings.
+* Portal options (`functional.portal.*`): Options to customize the openDesk portal, e.g. if the login dialog should be enforced.
+* Chat options (`functional.chat.*`): Configuration options for the chat component of openDesk.
+* Migration options (`functional.migration.*`): Helpful setting(s) for migration scenarios.
+
+## Customization of functional options
+
+In case the options from [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl) are not sufficient, you might want to look into [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl). The customizations give you control over all templating that is being done in openDesk, but be aware it is an unsupported approach, so in case you have a strong need for customizations, please let us know by opening a ticket. We will check if it is a use case that can be supported by implementing it as part of the aforementioned [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl).
+
+> **Note<br>**
+> You can not directly template your own values in the structure found in [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl), rather, you need to reference your custom value files to overwrite the openDesk defaults. In the app specific `helmfile-child.yaml.gotmpl` files, the openDesk value files are referenced first, then afterwards, the files you define in the customizations are read.

docs/getting-started.md

@@ -20,6 +20,7 @@ This documentation lets you create an openDesk evaluation instance on your Kuber
     * [Ingress](#ingress)
     * [Container runtime](#container-runtime)
     * [Volumes](#volumes)
+  * [Customize deployment](#customize-deployment)
   * [Connectivity](#connectivity)
     * [Ports](#ports)
       * [Web-based user interface](#web-based-user-interface)
@@ -57,22 +58,22 @@ For the following guide, we will use `dev` as environment where variables can be
 ## DNS
 
 The deployment is designed to deploy each application/service under a dedicated subdomain.
-For your convenience, we recommend creating a `*.domain.tld` A-Record to your cluster ingress controller; otherwise, you must create an A-Record for each subdomain.
+For your convenience, we recommend creating a `*.domain.tld` A-Record for your cluster Ingress Controller; otherwise, you must create an A-Record for each subdomain.
 
-| Record name                   | Type | Value                                              | Additional information                                           |
-| ----------------------------- | ---- | -------------------------------------------------- | ---------------------------------------------------------------- |
-| *.domain.tld                  | A    | IPv4 address of your Ingress Controller            |                                                                  |
-| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            |                                                                  |
-| mail.domain.tld               | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
-| mail.domain.tld               | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
-| domain.tld                    | MX   | `10 mail.domain.tld`                               |                                                                  |
-| domain.tld                    | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                       |
-| _dmarc.domain.tld             | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                         |
-| default._domainkey.domain.tld | TXT  | `v=DKIM1; k=rsa; h=sha256; ...`                    | Optional DKIM settings                                           |
+| Record name                   | Type | Value                                              | Additional information                                            |
+|-------------------------------|------|----------------------------------------------------|-------------------------------------------------------------------|
+| *.domain.tld                  | A    | IPv4 address of your Ingress Controller            |                                                                   |
+| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            |                                                                   |
+| mail.domain.tld               | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional, mail should directly be delivered to openDesk's Postfix |
+| mail.domain.tld               | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional, mail should directly be delivered to openDesk's Postfix |
+| domain.tld                    | MX   | `10 mail.domain.tld`                               |                                                                   |
+| domain.tld                    | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                        |
+| _dmarc.domain.tld             | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                          |
+| default._domainkey.domain.tld | TXT  | `v=DKIM1; k=rsa; h=sha256; ...`                    | Optional, DKIM settings                                           |
 
 ## Domain
 
-A list of all subdomains can be found in `helmfile/environments/default/global.gotmpl`.
+A list of all subdomains can be found in `helmfile/environments/default/global.yaml.gotmpl`.
 
 All subdomains can be customized. For example, _Nextcloud_ can be changed to `files.domain.tld` in `dev` environment:
 
@@ -82,14 +83,14 @@ global:
     nextcloud: "files"
 ```
 
-The domain has to be set either via `dev` environment
+The domain has to be set either via `dev` environment:
 
 ```yaml
 global:
   domain: "domain.tld"
 ```
 
-or via environment variable
+or alternatively via environment variable:
 
 ```shell
 export DOMAIN=domain.tld
@@ -97,50 +98,52 @@ export DOMAIN=domain.tld
 
 ### Apps
 
-All available apps and their default value are in `helmfile/environments/default/opendesk_main.gotmpl`.
+Depending on your ideal openDesk deployment, you may wish to disable or enable certain apps.
+All available apps and their default values are located in `helmfile/environments/default/opendesk_main.yaml.gotmpl`.
 
 | Component            | Name                        | Default | Description                    |
 | -------------------- | --------------------------- | ------- | ------------------------------ |
-| Certificates         | `certificates.enabled`      | `true`  | TLS certificates               |
-| ClamAV (Distributed) | `clamavDistributed.enabled` | `false` | Antivirus engine               |
-| ClamAV (Simple)      | `clamavSimple.enabled`      | `true`  | Antivirus engine               |
-| Collabora            | `collabora.enabled`         | `true`  | Weboffice                      |
-| CryptPad             | `cryptpad.enabled`          | `true`  | Weboffice                      |
-| dkimpy               | `dkimpy.enabled`            | `false` | Postfix milter for DKIM        |
-| Dovecot              | `dovecot.enabled`           | `true`  | Mail backend                   |
-| Element              | `element.enabled`           | `true`  | Secure communications platform |
-| Home                 | `home.enabled`              | `true`  | Base domain portal redirect    |
-| Jitsi                | `jitsi.enabled`             | `true`  | Videoconferencing              |
-| MariaDB              | `mariadb.enabled`           | `true`  | Database                       |
-| Memcached            | `memcached.enabled`         | `true`  | Cache Database                 |
-| MinIO                | `minio.enabled`             | `true`  | Object Storage                 |
-| Nextcloud            | `nextcloud.enabled`         | `true`  | File share                     |
-| Nubus                | `nubus.enabled`             | `true`  | Identity Management & Portal   |
-| OpenProject          | `openproject.enabled`       | `true`  | Project management             |
-| OX App Suite         | `oxAppSuite.enabled`        | `true`  | Groupware                      |
-| Postfix              | `postfix.enabled`           | `true`  | MTA                            |
-| PostgreSQL           | `postgresql.enabled`        | `true`  | Database                       |
-| Redis                | `redis.enabled`             | `true`  | Cache Database                 |
-| XWiki                | `xwiki.enabled`             | `true`  | Knowledge management           |
+| Certificates         | `apps.certificates.enabled`      | `true`  | TLS certificates               |
+| ClamAV (Distributed) | `apps.clamavDistributed.enabled` | `false` | Antivirus engine               |
+| ClamAV (Simple)      | `apps.clamavSimple.enabled`      | `true`  | Antivirus engine               |
+| Collabora            | `apps.collabora.enabled`         | `true`  | Weboffice                      |
+| CryptPad             | `apps.cryptpad.enabled`          | `true`  | Weboffice                      |
+| dkimpy               | `apps.dkimpy.enabled`            | `false` | Postfix milter for DKIM        |
+| Dovecot              | `apps.dovecot.enabled`           | `true`  | Mail backend                   |
+| Element              | `apps.element.enabled`           | `true`  | Secure communications platform |
+| Home                 | `apps.home.enabled`              | `true`  | Base domain portal redirect    |
+| Jitsi                | `apps.jitsi.enabled`             | `true`  | Videoconferencing              |
+| MariaDB              | `apps.mariadb.enabled`           | `true`  | Database                       |
+| Memcached            | `apps.memcached.enabled`         | `true`  | Cache Database                 |
+| MinIO                | `apps.minio.enabled`             | `true`  | Object Storage                 |
+| Nextcloud            | `apps.nextcloud.enabled`         | `true`  | File share                     |
+| Nubus                | `apps.nubus.enabled`             | `true`  | Identity Management & Portal   |
+| OpenProject          | `apps.openproject.enabled`       | `true`  | Project management             |
+| OX App Suite         | `apps.oxAppSuite.enabled`        | `true`  | Groupware                      |
+| Postfix              | `apps.postfix.enabled`           | `true`  | MTA                            |
+| PostgreSQL           | `apps.postgresql.enabled`        | `true`  | Database                       |
+| Redis                | `apps.redis.enabled`             | `true`  | Cache Database                 |
+| XWiki                | `apps.xwiki.enabled`             | `true`  | Knowledge management           |
 
-Exemplary, Jitsi can be disabled like:
+For example, Jitsi can be disabled like this:
 
 ```yaml
-jitsi:
-  enabled: false
+apps:
+  jitsi:
+    enabled: false
 ```
 
 ## Private registries
 
 By default, Helm charts and container images are fetched from OCI registries. These registries can be found in most cases
-in the [openDesk/component section on Open CoDE](https://gitlab.opencode.de/bmi/opendesk/components).
+in the [openDesk/component section on openCode](https://gitlab.opencode.de/bmi/opendesk/components).
 
 For untouched upstream artifacts that do not belong to a functional component's core, we use upstream registries
 like Docker Hub.
 
 Doing a test deployment will be fine with this setup. In case you want to deploy multiple times a day
-and fetch from the same IP address, you might run into rate limits at Docker Hub. In that case and in cases you
-prefer the use of a private image registry, you can configure such for
+and fetch from the same IP address, you might run into rate limits at Docker Hub. In that case, and in case you
+prefer the use of a private image registry, you can configure these in
 [your target environment](../helmfile/environments/dev/values.yaml.gotmpl.sample) by setting
 - `global.imageRegistry` for a private image registry and
 - `global.helmRegistry` for a private Helm chart registry.
@@ -156,7 +159,7 @@ alternatively, you can use an environment variable:
 export PRIVATE_IMAGE_REGISTRY_URL=my_private_registry.domain.tld
 ```
 
-or control repository override fine-granular per registry:
+or for more granular control over repository overrides per registry (rewrites):
 
 ```yaml
 repositories:
@@ -177,9 +180,9 @@ global:
 
 ### Service
 
-Some apps, like Jitsi or Dovecot, require HTTP and external TCP connections.
+Some apps, like Jitsi and Dovecot, require HTTP and external TCP connections.
 These apps create a Kubernetes service object.
-You can configure whether `NodePort` (for on-premise), `LoadBalancer` (for cloud), or `ClusterIP` (to disable) should be
+You can configure whether `NodePort` (for on-premises), `LoadBalancer` (for cloud), or `ClusterIP` (to disable) should be
 used:
 
 ```yaml
@@ -190,7 +193,7 @@ cluster:
 
 ### Networking
 
-If your cluster has not the default `cluster.local` domain configured, you need to provide the domain via:
+If your cluster does not have the default `cluster.local` domain configured, you need to provide the domain via:
 
 ```yaml
 cluster:
@@ -198,7 +201,7 @@ cluster:
     domain: "acme.internal"
 ```
 
-If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via the following:
+If your cluster does not have the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via the following:
 
 ```yaml
 cluster:
@@ -207,8 +210,8 @@ cluster:
       - "127.0.0.0/8"
 ```
 
-If your load balancer / reverse proxy IPs are not already covered by the above `cidr` you need to
-explicitly configure the related IPs or IP ranges:
+If your load balancer / reverse proxy IPs are not already included in the above `cidr` you need to
+explicitly configure their related IPs or IP ranges:
 
 ```yaml
 cluster:
@@ -219,19 +222,21 @@ cluster:
 
 ### Ingress
 
-By default, the `ingressClassName` is empty to select your default ingress controller. You may want to customize it by
-setting the following attribute to the name of the currently only supported ingress controller `ingress-nginx` (see
-[requirements.md](requirements.md)) for reference) within your deployment if that is not the cluster's default ingress.
+By default, the `ingressClassName` is empty and selects the default ingress controller in your cluster. You can customize it by
+setting the following attribute to the name of the ingress controller the within your deployment you wish to use. Useful if the ingress controller you wish to use is not the default.
 
 ```yaml
 ingress:
   ingressClassName: "name-of-my-nginx-ingress"
 ```
 
+Currently, the only supported ingress controller is `ingress-nginx` (see
+[requirements.md](./docs/requirements.md) for reference).
+
 ### Container runtime
 
 Some apps require specific configurations for the container runtime. You can set your container runtime like `cri-o`,
-`containerd` or `docker` by:
+`containerd` or `docker` by using the following attribute:
 
 ```yaml
 cluster:
@@ -240,7 +245,7 @@ cluster:
 ```
 
 ### Volumes
-The **StorageClass** must be set by:
+The StorageClass must be set using the following attribute:
 
 ```yaml
 persistence:
@@ -250,8 +255,8 @@ persistence:
 ```
 
 `RWX` is optional and requires that your cluster has a `ReadWriteMany` volume provisioner. If you can make use
-of it it benefits the distribution or scaling of apps. By default, only `ReadWriteOnce` is enabled.
-To enable `ReadWriteMany` you have to set:
+of it, it largely benefits the distribution and scaling of apps. By default, only `ReadWriteOnce` is enabled.
+To enable `ReadWriteMany` you can use the following attribute:
 
 ```yaml
 cluster:
@@ -259,13 +264,16 @@ cluster:
     readWriteMany: true
 ```
 
+## Customize deployment
 
+While openDesk configures the applications with meaningful defaults, you can check [functional.md](./docs/functional.md) if you want to change these defaults to better match your use case.
 
 ## Connectivity
 
 ### Ports
 
-**Note:** If you use `NodePort` for service exposure, you must check your deployment for the actual ports.
+> **Note**<br>
+> If you use `NodePort` for service exposure, you must check your deployment for the actual ports and ensure they are opened where necessary.
 
 #### Web-based user interface
 
@@ -279,7 +287,7 @@ To use the openDesk functionality with its web-based user interface, you need to
 
 #### Mail clients
 
-To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), the following ports need public exposure:
+To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), the following ports need to be publicly exposed:
 
 | Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
@@ -291,7 +299,7 @@ To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), t
 ### Mail/SMTP configuration
 
 To use the full potential of the openDesk, you need to set up an SMTP relay that allows sending emails from
-the whole subdomain.
+the whole subdomain. The following attribute can be set:
 
 ```yaml
 smtp:
@@ -301,11 +309,13 @@ smtp:
 ```
 
 Enabling DKIM signing of emails helps to reduce spam and increases trust.
-openDesk ships dkimpy-milter as Postfix milter for signing emails.
+openDesk ships dkimpy-milter as Postfix milter for signing emails. The following attributes can be set:
 
 ```yaml
-dkimpy:
-  enable: true
+apps:
+  dkimpy:
+    enabled: true
+smtp:
   dkim:
     key:
       value: "HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E="
@@ -332,16 +342,17 @@ turn:
 
 ### Certificate issuer
 
-As mentioned in [requirements](requirements.md#certificate-management), you can provide your own valid certificate. A TLS
+As mentioned in [requirements](requirements.md#certificate-management), you can provide your own valid certificate. A TLS type
 secret named `opendesk-certificates-tls` must be present in the application namespace. For deployment, you can
-turn off `Certificate` resource creation by:
+turn off `Certificate` resource creation with:
 
 ```yaml
-certificates:
-  enabled: false
+apps:
+  certificates:
+    enabled: false
 ```
 
-If you want to leverage the `cert-manager.io` to handle certificates, like `Let's encrypt`, you need to provide the
+If you want to leverage `cert-manager.io` to handle certificates, like `Let's encrypt`, you need to provide the
 configured cluster issuer:
 
 ```yaml
@@ -350,7 +361,7 @@ certificate:
     name: "letsencrypt-prod"
 ```
 
-Additionally, it is possible to request wildcard certificates by:
+Additionally, it is possible to request wildcard certificates with:
 
 ```yaml
 certificate:
@@ -383,13 +394,13 @@ helmfile apply -e dev -n <NAMESPACE> [-l <label>] [--suppress-diff]
 
 ## Install single app
 
-You can also install or upgrade only a single app like Collabora, either by label selector:
+You can also install or upgrade only a single app like Collabora, either by using a label selector:
 
 ```shell
 helmfile apply -e dev -n <NAMESPACE> -l component=collabora
 ```
 
-or by switching into the apps' directory (faster):
+or by switching to the apps' directory (faster) and install or upgrade from there directly:
 
 ```shell
 cd helmfile/apps/collabora
@@ -398,7 +409,7 @@ helmfile apply -e dev -n <NAMESPACE>
 
 ## Install single release/chart
 
-Instead of iteration through all services, you can also deploy a single release like `mariadb` by:
+Instead of iterating through all services, you can also deploy a single release like `mariadb` by executing the following:
 
 ```shell
 helmfile apply -e dev -n <NAMESPACE> -l name=mariadb
@@ -406,17 +417,17 @@ helmfile apply -e dev -n <NAMESPACE> -l name=mariadb
 
 # Access deployment
 
-When all apps are successfully deployed, and their Pod's status is `Running` or `Succeeded`, you can navigate to
+When all apps are successfully deployed, and their Pod status is `Running` or `Succeeded`, you can navigate to
 
 ```text
 https://portal.domain.tld
 ```
 
-If you change the subdomain of `nubus`, you must replace `portal` with the specified subdomain.
+If you change the subdomain of `nubus`, you must replace the subdomain of `portal` with the same subdomain.
 
 **Credentials:**
 
-openDesk deploys with the standard user account `Administrator`, which password you get retrieved as follows:
+openDesk deploys with the standard user account `Administrator`, the password for which can be retrieved as follows:
 
 ```shell
 # Set your namespace
@@ -430,8 +441,8 @@ Using the aforementioned account, you can either create new accounts manually or
 [openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import/)
 script or container.
 
-For example you get a `default` and `default-admin` account by running the following snippet, after settings the
-appropriate values in the first three lines.
+In the following snippet, after defining the values of the first three lines and executing the command,
+you get two accounts, `default` and `default-admin`:
 
 ```shell
 ADMINISTRATOR_PASSWORD=<your_administrator_password_see_above>
@@ -460,7 +471,7 @@ configuration values are:
 
 # Uninstall
 
-You can uninstall the deployment by:
+You can uninstall the deployment by executing the following:
 
 ```shell
 helmfile destroy -n <NAMESPACE>
@@ -486,4 +497,4 @@ kubectl delete configmaps --all --namespace ${NAMESPACE};
 ```
 
 > **Warning**<br>
-> Without specifying or empty `--namespace` flag, cluster-wide components get deleted!
+> Without specifying a `--namespace` flag, or by leaving it empty, cluster-wide components will get deleted!

docs/migrations.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
 
@@ -9,25 +9,35 @@ SPDX-License-Identifier: Apache-2.0
 * [Disclaimer](#disclaimer)
 * [Automated migrations - Overview and mandatory upgrade path](#automated-migrations---overview-and-mandatory-upgrade-path)
 * [Manual checks/actions](#manual-checksactions)
-  * [From v1.1.0](#from-v110)
-    * [Pre-upgrade from v1.1.0](#pre-upgrade-from-v110)
+  * [v1.4.0+](#v140)
+    * [Pre-upgrade to v1.4.0+](#pre-upgrade-to-v140)
+      * [Helmfile cleanup: `global.additionalMailDomains` as list](#helmfile-cleanup-globaladditionalmaildomains-as-list)
+  * [v1.2.0+](#v120)
+    * [Pre-upgrade to v1.2.0+](#pre-upgrade-to-v120)
+      * [Helmfile cleanup: Do not configure OX provisioning when no OX installed](#helmfile-cleanup-do-not-configure-ox-provisioning-when-no-ox-installed)
+      * [Helmfile new default: PostgreSQL for XWiki and Nextcloud](#helmfile-new-default-postgresql-for-xwiki-and-nextcloud)
+  * [v1.1.2+](#v112)
+    * [Pre-upgrade to v1.1.2+](#pre-upgrade-to-v112)
+      * [Helmfile feature update: App settings wrapped in `apps.` element](#helmfile-feature-update-app-settings-wrapped-in-apps-element)
+  * [v1.1.1+](#v111)
+    * [Pre-upgrade to v1.1.1](#pre-upgrade-to-v111)
       * [Helmfile feature update: Component specific `storageClassName`](#helmfile-feature-update-component-specific-storageclassname)
       * [Helmfile new secret: `secrets.nubus.masterpassword`](#helmfile-new-secret-secretsnubusmasterpassword)
-  * [From v1.0.0](#from-v100)
-    * [Pre-upgrade from v1.0.0](#pre-upgrade-from-v100)
+  * [v1.1.0+](#v110)
+    * [Pre-upgrade to v1.1.0](#pre-upgrade-to-v110)
       * [Helmfile cleanup: Restructured `/helmfile/files/theme` folder](#helmfile-cleanup-restructured-helmfilefilestheme-folder)
       * [Helmfile cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
       * [Helmfile cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
-      * [Helmfile cleanup: Helmfile cleanup: Splitting external vs. openDesk services](#helmfile-cleanup-helmfile-cleanup-splitting-external-vs-opendesk-services)
+      * [Helmfile cleanup: Splitting external services and openDesk services](#helmfile-cleanup-splitting-external-services-and-opendesk-services)
       * [Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names](#helmfile-cleanup-streamlining-openxchange-and-oxappsuite-attribute-names)
       * [Helmfile feature update: Dicts to define `customization.release`](#helmfile-feature-update-dicts-to-define-customizationrelease)
       * [openDesk defaults (new): Enforce login](#opendesk-defaults-new-enforce-login)
       * [openDesk defaults (changed): Jitsi room history enabled](#opendesk-defaults-changed-jitsi-room-history-enabled)
       * [External requirements: Redis 7.4](#external-requirements-redis-74)
-    * [Post-upgrade from v1.0.0](#post-upgrade-from-v100)
+    * [Post-upgrade to v1.1.0+](#post-upgrade-to-v110)
       * [XWiki fix-ups](#xwiki-fix-ups)
-  * [From v0.9.0](#from-v090)
-    * [Pre-upgrade from v0.9.0](#pre-upgrade-from-v090)
+  * [v1.1.0](#v110-1)
+    * [Pre-upgrade to v1.1.0](#pre-upgrade-to-v110-1)
       * [Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus](#configuration-cleanup-removal-of-unnecessary-ox-profiles-in-nubus)
       * [Configuration Cleanup: Updated `global.imagePullSecrets`](#configuration-cleanup-updated-globalimagepullsecrets)
       * [Changed openDesk defaults: Matrix presence status disabled](#changed-opendesk-defaults-matrix-presence-status-disabled)
@@ -35,17 +45,20 @@ SPDX-License-Identifier: Apache-2.0
       * [Changed openDesk defaults: File-share configurability](#changed-opendesk-defaults-file-share-configurability)
       * [Changed openDesk defaults: Updated default subdomains in `global.hosts`](#changed-opendesk-defaults-updated-default-subdomains-in-globalhosts)
       * [Changed openDesk defaults: Dedicated group for access to the UDM REST API](#changed-opendesk-defaults-dedicated-group-for-access-to-the-udm-rest-api)
-    * [Post-upgrade from v0.9.0](#post-upgrade-from-v090)
+    * [Post-upgrade to v1.0.0+](#post-upgrade-to-v100)
       * [Configuration Improvement: Separate user permission for using Video Conference component](#configuration-improvement-separate-user-permission-for-using-video-conference-component)
       * [Optional Cleanup](#optional-cleanup)
-  * [From v0.8.1](#from-v081)
-    * [Pre-upgrade from v0.8.1](#pre-upgrade-from-v081)
+  * [v0.9.0](#v090)
+    * [Pre-upgrade to v0.9.0](#pre-upgrade-to-v090)
       * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
       * [Updated customizable template attributes](#updated-customizable-template-attributes)
       * [`migrations` S3 bucket](#migrations-s3-bucket)
 * [Automated migrations - Details](#automated-migrations---details)
-  * [From v1.0.0 (automated)](#from-v100-automated)
-  * [From v0.9.0 (automated)](#from-v090-automated)
+  * [v1.2.0+ (automated)](#v120-automated)
+    * [migrations-pre](#migrations-pre)
+    * [migrations-post](#migrations-post)
+  * [v1.1.0+ (automated)](#v110-automated)
+  * [v1.0.0+ (automated)](#v100-automated)
   * [Related components and artifacts](#related-components-and-artifacts)
   * [Development](#development)
 <!-- TOC -->
@@ -54,55 +67,176 @@ SPDX-License-Identifier: Apache-2.0
 
 Starting with openDesk 1.0, we aim to offer hassle-free updates/upgrades.
 
-Therefore openDesk contains automated migrations between versions to lower the requirements for manual interaction. These automated migrations can have limitations in the way that they need a certain openDesk version to be installed causing a mandatory upgrade path that is described in the section [Automated migrations](#automated-migrations).
+Therefore, openDesk contains automated migrations between versions which reduces the need for manual interaction.
+
+These automated migrations have limitations in the sense that they require a certain openDesk version to be installed, effectively resulting in a forced upgrade path. This is highlighted in the section [Automated migrations](#automated-migrations).
 
 Manual checks and possible activities are also required by openDesk updates, they are described in the section [Manual update steps](#manual-update-steps).
 
 > **Note**<br>
-> Please be sure you read / follow the requirements before you update / upgrade thoroughly.
+> Please be sure to _thoroughly_ read / follow the requirements before you update / upgrade.
 
 > **Known limitations**<br>
-> We assume that the PV reclaim policy is set to `delete`, resulting in PVs getting deleted as soon as the related PVC was deleted; we will not address explicit deletion for PVs.
+> We assume that the PV reclaim policy is set to `delete`, resulting in PVs getting deleted as soon as the related PVC is deleted; we will not address explicit deletion for PVs.
 
 # Automated migrations - Overview and mandatory upgrade path
 
-The following table gives an overview of the mandatory upgrade path of openDesk for the automated migrations to work as expected.
+The following table gives an overview of the mandatory upgrade path of openDesk, required in order for the automated migrations to work as expected.
 
-To upgrade existing deployments, you cannot skip any version mentioned in the column *Mandatory version*. When a version number is not fully defined (e.g. `v1.1.x`), you can install any version matching the given schema.
+To upgrade existing deployments, you cannot skip any version mentioned in the column *Mandatory version*. When a version number is not fully defined (e.g. `v1.1.x`), you can install any version matching that constraint.
 
 | Mandatory version |
 | ----------------- |
+<!--| v1.2+             | add the entry to the table as soon as we get new migration requiring the set version (range) to be deployed first -->
 | v1.1.x            |
 | v1.0.0            |
 | v0.9.0            |
 | v0.8.1            |
 
 > **Note**<br>
-> Be sure you check out the table in the release version you are going to install, an not the one that is currently installed.
+> Be sure to check out the table in the release version you are going to install, and not the currently installed version.
 
-When interested in more details about the automated migrations, please read section [Automated migrations - Details](#automated-migrations---details).
+If you would like more details about the automated migrations, please read section [Automated migrations - Details](#automated-migrations---details).
 
 # Manual checks/actions
 
-Be sure you check all the sections for the releases your are going to update your current deployment from.
+## v1.4.0+
 
-## From v1.1.0
+### Pre-upgrade to v1.4.0+
 
-### Pre-upgrade from v1.1.0
+#### Helmfile cleanup: `global.additionalMailDomains` as list
+
+**Target group:** Installations that have set `global.additionalMailDomains`.
+
+The `additionalMailDomains` had to be defined as a comma separated string. That now needs to change into a list of domains.
+
+For example the following config:
+
+```yaml
+global:
+  additionalMailDomains: "sub1.maildomain.de,sub2.maildomain.de"
+```
+
+Needs to change to:
+
+```yaml
+global:
+  additionalMailDomains:
+    - "sub1.maildomain.de"
+    - "sub2.maildomain.de"
+```
+
+## v1.2.0+
+
+### Pre-upgrade to v1.2.0+
+
+#### Helmfile cleanup: Do not configure OX provisioning when no OX installed
+
+**Target group:** Installations that have no OX App Suite installed.
+
+With openDesk 1.2.0 the OX provisioning consumer will not be registered when there is no OX installed.
+
+We do not remove the consumer for existing installations, if you want to do that for your existing installation please perform the following steps:
+
+```shell
+export NAMESPACE=<your_namespace>
+kubectl -n ${NAMESPACE} exec -it ums-provisioning-nats-0 -c nats-box -- sh -c 'nats consumer rm stream:ox-connector durable_name:ox-connector --user=admin --password=${NATS_PASSWORD} --force'
+kubectl -n ${NAMESPACE} exec -it ums-provisioning-nats-0 -c nats-box -- sh -c 'nats stream rm stream:ox-connector --user=admin --password=${NATS_PASSWORD} --force'
+kubectl -n ${NAMESPACE} delete secret ums-provisioning-ox-credentials-test
+```
+
+#### Helmfile new default: PostgreSQL for XWiki and Nextcloud
+
+**Target group:** All upgrade installations that do not already use the previous optional PostgreSQL database backend for Nextcloud and XWiki.
+
+openDesk now uses PostgreSQL as default database backend for Nextcloud and XWiki.
+
+When upgrading existing instances you likely want to keep the current database backend (MariaDB).
+
+**Use case A:** You use your own external database services, if not see "Use case B" further down.
+
+You just have to add the new `type` attribute and set it to `mariadb`:
+
+```yaml
+databases:
+  nextcloud:
+    type: "mariadb"
+  xwiki:
+    type: "mariadb"
+```
+
+**Use case B:** You use the openDesk supplied database services.
+
+Ensure you set the following attributes before upgrading, this includes the aforementioned `type` attribute.
+
+```yaml
+databases:
+  nextcloud:
+    type: "mariadb"
+    host: "mariadb"
+    port: 3306
+  xwiki:
+    type: "mariadb"
+    host: "mariadb"
+    port: 3306
+    username: "root"
+```
+
+In case you are planning to migrate an existing instance from MariaDB to PostgreSQL please check the upstream documentation for details:
+
+- Nextcloud database migration: https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/db_conversion.html
+- XWiki:
+  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Backup#HUsingtheXWikiExportfeature
+  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/ImportExport
+
+## v1.1.2+
+
+### Pre-upgrade to v1.1.2+
+
+#### Helmfile feature update: App settings wrapped in `apps.` element
+
+We now require [Helmfile v1.0.0-rc.8](https://github.com/helmfile/helmfile/releases/tag/v1.0.0-rc.8) for the deployment. This enables openDesk to lay the foundation for some significant cleanups where the information from the different apps, especially their `enabled` state, is needed.
+
+Therefore, it was necessary to introduce the `apps` level in [`opendesk_main.yaml.gotmpl`](../helmfile/environments/default/opendesk_main.yaml.gotmpl).
+
+If you have a deployment where you specify settings found in the aforementioned file, specifically to disable or enable components, please ensure you insert the top-level attribute `apps` as shown in the following example.
+
+The following configuration:
+
+```yaml
+certificates:
+  enabled: false
+notes:
+  enabled: true
+```
+
+Needs to be changed to:
+
+```yaml
+apps:
+  certificates:
+    enabled: false
+  notes:
+    enabled: true
+```
+
+## v1.1.1+
+
+### Pre-upgrade to v1.1.1
 
 #### Helmfile feature update: Component specific `storageClassName`
 
-With openDesk 1.1.1 we support component specific `storageClassName` definitions beside the global ones, but we had to adapt the structure that can be found in `persistence.yaml.gotmpl` to achieve this in a clean manner.
+With openDesk 1.1.1 we support component specific `storageClassName` definitions beside the global ones. For this, we had to adapt the structure found in `persistence.yaml.gotmpl` to achieve this in a clean manner.
 
 If you have set custom `persistence.size.*`-values for your deployment, please continue reading as you need to adapt your `persistence` settings to the new structure.
 
-When comparing the [old 1.1.0 structure](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/v1.1.0/helmfile/environments/default/persistence.yaml.gotmpl) with the [new one](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/v1.1.1/helmfile/environments/default/persistence.yaml.gotmpl) you can spot the changes:
+When comparing the [old v1.1.0 structure](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/v1.1.0/helmfile/environments/default/persistence.yaml.gotmpl) with the [new one](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/v1.1.1/helmfile/environments/default/persistence.yaml.gotmpl), you will spot these changes:
 
 - We replaced `persistence.size` with `persistence.storages`.
 - Below each component you can define now the `size` and the optional component specific `storageClassName`.
-- We streamlined all components to be on the same level, as Nubus had an additional level of nesting before.
+- We streamlined the structure of the components by placing them on the same level, as beforehand, Nubus had an additional level of nesting.
 
-So a setting of:
+The following configuration:
 
 ```yaml
 persistence:
@@ -110,7 +244,7 @@ persistence:
     synapse: "1Gi"
 ```
 
-needs to be changed to:
+Needs to be changed to:
 
 ```yaml
 persistence:
@@ -119,7 +253,7 @@ persistence:
       size: "1Gi"
 ```
 
-or for the Nubus related entries, the following:
+Or for the Nubus related entries, the following:
 
 ```yaml
 persistence:
@@ -128,7 +262,7 @@ persistence:
       ldapServerData: "1Gi"
 ```
 
-needs to be changed to:
+Needs to be changed to:
 
 ```yaml
 persistence:
@@ -139,29 +273,29 @@ persistence:
 
 #### Helmfile new secret: `secrets.nubus.masterpassword`
 
-A not yet templated secret was discovered in the Nubus deployment that is now defined in [`secrets.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl) with the key `secrets.nubus.masterpassword`. If you define your own secrets, please be sure this new secret is set to the value of the `MASTER_PASSWORD` environment variable used in your deployment.
+A not yet templated secret was discovered in the Nubus deployment. It is now declared in [`secrets.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl) and can be defined using: `secrets.nubus.masterpassword`. If you define your own secrets, please be sure this new secret is set to the same value as the `MASTER_PASSWORD` environment variable used in your deployment.
 
-## From v1.0.0
+## v1.1.0+
 
-### Pre-upgrade from v1.0.0
+### Pre-upgrade to v1.1.0
 
 #### Helmfile cleanup: Restructured `/helmfile/files/theme` folder
 
-If you make use of the [theme folder](../helmfile/files/theme/) or the [`theme.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl), e.g. to applying your own imagery, please ensure you adhere to the new structure of the folder and the yaml-file.
+If you make use of the [theme folder](../helmfile/files/theme/) or the [`theme.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl), e.g. to apply your own imagery, please ensure you adhere to the new structure of the folder and the yaml-file.
 
 #### Helmfile cleanup: Consistent use of `*.yaml.gotmpl`
 
-In v1.0.0 the files in [`/helmfile/environments/default`](../helmfile/environments/default/) had mixed extensions,
-we have streamlined them to consistently use `*.yaml.gotmpl`.
+In v1.0.0 the files in [`/helmfile/environments/default`](../helmfile/environments/default/) had mixed file extensions.
+Now we have streamlined this and consistently use the `*.yaml.gotmpl` file extension.
 
-This change requires manual action likely in two situations:
+This change likely requires manual action in two situations:
 
-1. You are referencing our upstream files from the aforementioned directory, e.g. in your Argo CD deployment. Please update your references to use the filenames with the new extension.
-2. You have custom files containing configuration information that are named just `*.yaml`: Please rename them to `*.yaml.gotmpl`.
+1. You are referencing our upstream files from the aforementioned directory, e.g. in your Argo CD deployment. If so, please update your references to use the filenames with the new extension.
+2. You have custom files containing configuration information that are simply named `*.yaml`. If so, please rename them to `*.yaml.gotmpl`.
 
 #### Helmfile cleanup: Prefixing certain app directories with `opendesk-`
 
-To make it more obvious that some elements from below the [`apps`](../helmfile/apps/) directory are completely
+To make it more obvious that some elements from within the [`apps`](../helmfile/apps/) directory are solely
 provided by openDesk, we have prefixed these app directories with `opendesk-`.
 
 Affected are the following directories, here listed directly with the new prefix:
@@ -172,28 +306,28 @@ Affected are the following directories, here listed directly with the new prefix
 
 The described changes most likely require manual action in the following situation:
 
-- You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.
+- You are referencing our upstream files e.g. in your Argo CD deployment. If so, please update your references to use the new directory names.
 
-#### Helmfile cleanup: Helmfile cleanup: Splitting external vs. openDesk services
+#### Helmfile cleanup: Splitting external services and openDesk services
 
 In v1.0.0 there was a directory `/helmfile/apps/services` that was intended to contain all the services an operator had to provide externally for production deployments.
 
-As some services that are actually part of openDesk snuck in there, so we had to split the directory into two separate ones:
+As some services that are actually part of openDesk snuck in there, we had to split the directory into two separate ones:
 
 - [`./helmfile/apps/opendesk-services`](../helmfile/apps/opendesk-services)
 - [`./helmfile/apps/services-external`](../helmfile/apps/services-external)
 
 The described changes most likely require manual action in the following situation:
 
-- You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.
+- You are referencing our upstream files e.g. in your Argo CD deployment. If so, please update your references to use the new directory names.
 
 #### Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names
 
-We have updated some attribute names around Open-Xchange / OX App Suite to be consistent within our Helmfile
-deployment and to aligning with the actual brand names as well as with our rule of thumb for brand based
+We have updated some attribute names within the Open-Xchange / OX App Suite to be consistent within our Helmfile
+deployment. This change also aligns us with the actual brand names, as well as our rule of thumb for brand based
 attribute names[^1].
 
-In case you are using any of the customizations below (`WAS`), please update as shown (`NOW`):
+In case you are using any of the customizations below, the (`WAS`) values, please update to the (`NOW`) values:
 
 ```
 WAS: oxAppsuite: ...
@@ -252,7 +386,9 @@ NOW: secrets.oxAppSuite: ...
 
 #### Helmfile feature update: Dicts to define `customization.release`
 
-If you make use of the `customization.release` option, you have to switch to a dictionary based definition of customization files e.g. from
+If you make use of the `customization.release` option, you have to switch to a dictionary based definition of customization files, for example:
+
+The following:
 
 ```yaml
 customization:
@@ -260,7 +396,7 @@ customization:
     collaboraOnline: "./my_custom_templating.yaml.gotmpl"
 ```
 
-to
+Needs to be changed to:
 
 ```yaml
 customization:
@@ -273,7 +409,7 @@ You can freely choose the `file1` dictionary key used in the example above, but
 
 #### openDesk defaults (new): Enforce login
 
-Users accessing the openDesk portal are now automatically redirected to the login screen as a default.
+Users accessing the openDesk portal are now automatically redirected to the login screen per default.
 
 In case you want to keep the previous behavior you need to set the following `functional` flag:
 
@@ -289,7 +425,7 @@ The default to store the Jitsi room history in the local storage of a user's bro
 
 It is now enabled and therefore stored by default.
 
-To preserve the 1.0.0 behavior of not storing the room history you have to explicitly configure it:
+To preserve the v1.0.0 behavior of not storing the room history you have to explicitly configure it:
 
 ```yaml
 functional:
@@ -300,45 +436,46 @@ functional:
 
 #### External requirements: Redis 7.4
 
-The update from openDesk 1.0.0 contains Redis 7.4.1, like the other openDesk bundled services the bundled Redis is as well not meant to be used in production.
+The update from openDesk v1.0.0 contains Redis 7.4.1, like the other openDesk bundled services, the bundled Redis is not meant to be used in production.
 
-Please ensure for the Redis you are using that it is updated to at least 7.4 to support the requirement of OX App Suite.
+Please ensure the Redis you are using is updated to at least version 7.4 to support the requirement of OX App Suite.
 
-### Post-upgrade from v1.0.0
+### Post-upgrade to v1.1.0+
 
 #### XWiki fix-ups
 
-Unfortunately XWiki does not upgrade itself as expected. A bug with the supplier has already been filed. The following additional steps are required:
+Unfortunately XWiki does not upgrade itself as expected. The bug has been reported and the supplier is aware. The following additional steps are required:
 
-1. To enforce re-indexing of the now fixed full-text search access the XWiki Pod and run the following commands to delete two search related directories. To complete this you need to restart the XWiki Pod, but that is anyway part of the next step:
+1. To enforce re-indexing of the now fixed full-text search, access the XWiki Pod and run the following commands to delete two search related directories:
    ```
    rm -rf /usr/local/xwiki/data/store/solr/search_9
    rm -rf /usr/local/xwiki/data/cache/solr/search_9
    ```
+> The pod will need to be restarted for the changes to take effect.
 
-2. This is necessary if the openDesk single sign-on does not longer work and you get a standard XWiki login dialogue instead.
-   - Find the XWiki ConfigMap `xwiki-init-scripts` and find in its `entrypoint` key data the lines beginning with `xwiki_replace_or_add "/usr/local/xwiki/data/xwiki.cfg"`
-   - Before those lines add the following line, of course setting `<YOUR_TEMPORARY_SUPERADMIN_PASSWORD>` to a value you are happy with.
+2. This is necessary if the openDesk single sign-on no longer works, and you get a standard XWiki login dialogue instead:
+   - Find the XWiki ConfigMap `xwiki-init-scripts` and locate in the `entrypoint` key the lines beginning with `xwiki_replace_or_add "/usr/local/xwiki/data/xwiki.cfg"`
+   - Before those lines, add the following line while setting `<YOUR_TEMPORARY_SUPERADMIN_PASSWORD>` to a value you are happy with:
      ```
          xwiki_replace_or_add "/usr/local/xwiki/data/xwiki.cfg" 'xwiki.superadminpassword' '<YOUR_TEMPORARY_SUPERADMIN_PASSWORD>'
      ```
    - Restart the XWiki Pod.
-   - Access XWiki's web UI and login with `superadmin` and the above set password.
+   - Access XWiki's web UI and login with `superadmin` and the password you set above.
    - Once XWiki UI is fully rendered, remove the line with the temporary `superadmin` password from the aforementioned ConfigMap.
    - Restart the XWiki Pod.
 
-You should have now a properly working XWiki instance with single sign-on and full-text search.
+You should have now a fully functional XWiki instance with single sign-on and full-text search.
 
-## From v0.9.0
+## v1.1.0
 
-### Pre-upgrade from v0.9.0
+### Pre-upgrade to v1.1.0
 
 #### Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus
 
 > **Warning**<br>
-> The upgrade will fail if you do not address this section for your current deployment.
+> The upgrade will fail if you do not address this section in your current deployment.
 
-The update will remove unnecessary OX-Profiles in Nubus, but it can not as long as these profiles are in use.
+The update will remove unnecessary OX-Profiles in Nubus, so long as these profiles are in use.
 
 So please ensure that only the following two supported profiles are assigned to your users:
 - `opendesk_standard`: "opendesk Standard"
@@ -356,14 +493,14 @@ You can review and update other accounts as follows:
   - Open the user.
   - Go to section "OX App Suite".
   - Change the value in the dropdown "OX Access" to either:
-    - "openDesk Standard" if the user should be able to use the Groupware module or
+    - "openDesk Standard" if the user should be able to use the Groupware module.
     - "Login disabled" if the user should not use the Groupware module.
   - Update the user account with the green "SAVE" button at the top of the page.
 
 #### Configuration Cleanup: Updated `global.imagePullSecrets`
 
-Without using a custom registry, you can pull all the openDesk images without authentication.
-Thus defining not existing imagePullSecrets creates unnecessary errors, so we removed them.
+Without using a custom container image registry, you can pull all the openDesk images without authentication.
+Thus defining non-existent imagePullSecrets creates unnecessary errors, so we removed them.
 
 You can keep the current settings by setting the `external-registry` in your custom environment values:
 
@@ -377,7 +514,7 @@ global:
 
 Show other user's Matrix presence status is now disabled by default to comply with data protection requirements.
 
-To enable it or keep the v0.9.0 default please set:
+To enable it or keep the v0.9.0 default, please set:
 
 ```yaml
 functional:
@@ -388,23 +525,22 @@ functional:
 
 #### Changed openDesk defaults: Matrix ID
 
-Until 0.9.0 openDesk used the LDAP entryUUID of a user to generate the user's Matrix ID. Due to restrictions on the
-Matrix protocol, an update of a Matrix ID is not possible; therefore, it was technically convenient to use the UUID
-as it is immutable (see https://de.wikipedia.org/wiki/Universally_Unique_Identifier for more details on UUIDs.)
+Until v0.9.0 openDesk used the LDAP entryUUID of a user to generate the user's Matrix ID. Due to restrictions of the
+Matrix protocol, an update to a Matrix ID is not possible. Therefore, it was technically convenient to use the UUID
+as they are immutable (see https://en.wikipedia.org/wiki/Universally_unique_identifier for more details on UUIDs.)
 
-From the user experience perspective, that was a flawed approach, so from openDesk 1.0 on, by default, the username which
-is also used for logging into openDesk is used to define the localpart of the Matrix ID.
+From the user experience perspective, that was a flawed approach, so from openDesk 1.0 onwards, by default, the openDesk login username is used to define the `localpart` of the Matrix ID.
 
 For existing installations: The changed setting only affects users who log in to Element for the first time. Existing
 user accounts will not be harmed. If you want existing users to get new Matrix IDs based on the new setting, you
-must update their external ID in Synapse and deactivate the old user afterward. The user will get a new
-Matrix account from scratch, losing the existing contacts, chats, and rooms.
+must update their external ID in Synapse and deactivate the old user afterward. The user will get a completely new
+Matrix account, losing their existing contacts, chats, and rooms.
 
 The following Admin API calls are helpful:
-- `GET /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain>` to get the user's existing external_id (auth_provider: "oidc")
-- `PUT /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain>` to update user's external_id with JSON payload:
+- `GET /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain>` get the user's existing external_id (auth_provider: "oidc")
+- `PUT /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain>` update user's external_id with JSON payload:
   `{ "external_ids": [ { "auth_provider": "oidc", "external_id": "<old_id>+deprecated" } ] }`
-- `POST /_synapse/admin/v1/deactivate/@<entryuuid>:<matrixdomain>` to deactivate old user with JSON payload:
+- `POST /_synapse/admin/v1/deactivate/@<entryuuid>:<matrixdomain>` deactivate old user with JSON payload:
   `{ "erase": true }`
 
 For more details, check the Admin API documentation:
@@ -421,7 +557,7 @@ functional:
 
 #### Changed openDesk defaults: File-share configurability
 
-Now, we provide some configurability regarding the sharing capabilities of the Nextcloud component.
+We now provide some configurability regarding the sharing capabilities of the Nextcloud component.
 
 See the settings under `functional.filestore` in [functional.yaml](../helmfile/environments/default/functional.yaml).
 
@@ -452,7 +588,7 @@ This results in the following changes to the default subdomain naming:
 - **nextcloud**: `fs` → `files`
 - **openproject**: `project` → `projects`
 
-Existing deployments should keep the old subdomains cause URL/link changes are not supported through all components.
+Existing deployments should keep the old subdomains because URL/link changes are not supported through all components.
 
 If you have not already defined the entire `global.hosts` dictionary in your custom environments values, please set it
 to the defaults that were used before the upgrade:
@@ -482,22 +618,21 @@ global:
     xwiki: "wiki"
 ```
 
-In case you would like to update an existing deployment to the new hostnames, please check the following list:
+In case you would like to update an existing deployment to use the new hostnames, you would be doing so at your own risk, so please consider the following:
 
-- Do this at your own risk.
 - Some of your user's bookmarks and links will stop working.
-- Portal links are getting updated automatically.
+- Portal links will get updated automatically.
 - The update of the OpenProject <-> Nextcloud file integration needs to be updated manually as follows:
-  - Use an account with functional admin permissions on both components
-  - In OpenProject: *Administration* > *Files* > *External file storages* > Select `Nextcloud at [your_domain]`
+  - Use an account with functional admin permissions for both Nextcloud and OpenProject
+  - In Nextcloud: *Administration* > *Files* > *External file storages* > Select `Nextcloud at [your_domain]`
     - Edit *Details* - *General Information* - *Storage provider* and update the *hostname* to `files.<your_domain>`
-  - In Nextcloud: *Administration* > *OpenProject* > *OpenProject server*
+  - In OpenProject: *Administration* > *OpenProject* > *OpenProject server*
     - Update the *OpenProject host* to `projects.<your_domain>`
 
 #### Changed openDesk defaults: Dedicated group for access to the UDM REST API
 
 Prerequisite: You allow the use of the [IAM's API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html)
-with the following settings:
+with the following setting:
 
 ```yaml
 functional:
@@ -507,36 +642,36 @@ functional:
         enabled: true
 ```
 
-With 0.9.0, all members of the group "Domain Admins" could successfully authenticate with the API.
+With v0.9.0, all members of the group "Domain Admins" could successfully authenticate with the API.
 
 With openDesk 1.0, we introduced a specific group for permission to use the API: `IAM API - Full Access`.
 
-The IAMs admin account `Administrator` is a member of this group by default, but no other user is.
+The IAM admin account `Administrator` is the only member of this group by default.
 
 If you need other accounts to use the API, please assign them to the aforementioned group.
 
-### Post-upgrade from v0.9.0
+### Post-upgrade to v1.0.0+
 
 #### Configuration Improvement: Separate user permission for using Video Conference component
 
 With openDesk 1.0 the user permission for authenticated access to the Chat and Video Conference components was split into two separate permissions.
 
-Therefore the newly added *Video Conference* permission has to be added to users that should have continued access to the component.
+Therefore, the newly added *Video Conference* permission has to be added to users that should have continued access to the component.
 
 This can be done as IAM admin:
 - Open the *user* module.
-- Select all users that should get the permission for *Video Conference* using the select box left from the users entry.
+- Select all users that should get the permission for *Video Conference* using the checkbox left of the users' entry.
 - In top bar of the user table click on *Edit*.
-- Select the *openDesk* section the the left-hand menu.
-- Check the check box for *Video Conference* and the directly below check box for *Overwrite*.
-- Click on the green *Save* button on top of the screen to apply the change.
+- Select the *openDesk* section from the left-hand menu.
+- Check the checkbox for *Video Conference* and the directly below check box for *Overwrite*.
+- Click on the green *Save* button at the top of the screen to apply the change.
 
 > **Hint**<br>
-> If you have a lot of users andd want to update (almost) all them, you can select all users by clicking the check box in the user's table header and then de-selecting the users you do not want to update.
+> If you have a lot of users and want to update (almost) all them, you can select all users by clicking the checkbox in the user's table header and then de-selecting the users you do not want to update.
 
 #### Optional Cleanup
 
-We do not execute possible cleanup steps as part of the migrations POST stage. So you might want to remove the no longer used PVCs after a successful upgrade:
+We do not execute possible cleanup steps as part of the migrations POST stage. So you might want to remove the unclaimed PVCs after a successful upgrade:
 
 ```shell
 NAMESPACE=<your_namespace>
@@ -545,13 +680,13 @@ kubectl -n ${NAMESPACE} delete pvc shared-run-ums-ldap-server-0
 kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
 ```
 
-## From v0.8.1
+## v0.9.0
 
-### Pre-upgrade from v0.8.1
+### Pre-upgrade to v0.9.0
 
 #### Updated `cluster.networking.cidr`
 
-- Action: `cluster.networking.cidr` is now an array (was a string until 0.8.1); please update your setup accordingly if you explicitly set this value.
+- Action: `cluster.networking.cidr` is now an array (was a string until v0.8.1); please update your setup accordingly if you explicitly set this value.
 - Reference:[cluster.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/cluster.yaml)
 
 #### Updated customizable template attributes
@@ -560,17 +695,31 @@ kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
 - References:
   - `functional.` prefix for `authentication.*`, `externalServices.*`, `admin.*` and `filestore.*`, see [functional.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/functional.yaml).
   - `debug.` prefix for `cleanup.*`, see [debug.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/debug.yaml).
-  - `monitoring.` prefix for `prometheus.*` and `graphana.*`, see [monitoring.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/monitoring.yaml).
+  - `monitoring.` prefix for `prometheus.*` and `grafana.*`, see [monitoring.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/monitoring.yaml).
   - `smtp.` prefix for `localpartNoReply`, see [smtp.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/smtp.yaml).
 
 #### `migrations` S3 bucket
 
-- Action: For self-managed/external S3/object storages, please ensure you add a bucket `migrations` to your S3.
+- Action: For self-managed/external S3/object storages, please create a bucket called `migrations` using your S3 endpoint.
 - Reference: `objectstores.migrations` in [objectstores.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/objectstores.yaml)
 
 # Automated migrations - Details
 
-## From v1.0.0 (automated)
+## v1.2.0+ (automated)
+
+> **Note**<br>
+> Details can be found in [run_4.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_4.py).
+
+### migrations-pre
+
+- Delete PVC `group-membership-cache-ums-portal-consumer-0`: With the upgrade the Nubus Portal Consumer no longer requires to be executed with root privileges. The PVC contains files that require root permission to access them, therefore the PVC gets deleted (and re-created) during the upgrade.
+- Delete StatefulSet `ums-portal-consumer`: A bug was fixed in the templating of the Portal Consumer's PVC causing the values in `persistence.storages.nubusPortalConsumer.*` to be ignored. As these values are immutable, we had to delete the whole StatefulSet.
+
+### migrations-post
+
+- Restarting Deployment `ums-provisioning-udm-transformer` and StatefulSet `ums-provisioning-udm-listener` as well as deleting the Nubus Provisioning consumer `durable_name:incoming` on stream `stream:incoming`: Due to a bug in Nubus 1.7.0 the `incoming` stream was blocked after the upgrade, the aforementioned measures unblock the stream.
+
+## v1.1.0+ (automated)
 
 With openDesk v1.1.0 the IAM stack supports HA LDAP primary as well as scalable LDAP secondary pods.
 
@@ -581,18 +730,18 @@ creating the config map with the mentioned label.
 > **Note**<br>
 > Details can be found in [run_3.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).
 
-## From v0.9.0 (automated)
+## v1.0.0+ (automated)
 
 The `migrations-pre` and `migrations-post` jobs in the openDesk deployment address the automated migration tasks.
 
-The permissions required to execute the migrations can be found in the migration's Helm chart [`role.yaml'](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/v1.3.5/charts/opendesk-migrations/templates/role.yaml?ref_type=tags#L29)
+The permissions required to execute the migrations can be found in the migration's Helm chart [`role.yaml'](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/v1.3.5/charts/opendesk-migrations/templates/role.yaml?ref_type=tags#L29).
 
 > **Note**<br>
 > Details can be found in [run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).
 
 ## Related components and artifacts
 
-openDesk comes with two upgrade steps as part of the deployment; they can be found in the folder [/helmfile/apps](../helmfile/apps/) as all other components:
+openDesk comes with two upgrade steps as part of the deployment; they can be found in the folder [/helmfile/apps](../helmfile/apps/) along with all other components:
 
 - `migrations-pre`: Is the very first app that gets deployed.
 - `migrations-post`: Is the last app that gets deployed.

docs/monitoring.md

@@ -6,7 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Monitoring</h1>
 
 This document will cover how you can enable observability with Prometheus-based monitoring and Grafana dashboards as
-well as the overall status of monitoring integration.
+well as the overall status of the monitoring integration.
 
 <!-- TOC -->
 * [Technology](#technology)
@@ -14,17 +14,16 @@ well as the overall status of monitoring integration.
 * [Metrics](#metrics)
 * [Alerts](#alerts)
 * [Dashboards for Grafana](#dashboards-for-grafana)
-* [Components](#components)
+* [Component overview](#component-overview)
 <!-- TOC -->
 
 # Technology
 
-We provide integration into the Prometheus-based monitoring.
-Together with
-[kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) you
-easily leverage the full potential of the open-source cloud-native observability stack.
+openDesk includes integration with Prometheus-based monitoring.
 
-Before enabling the following options, you need to install the respective CRDs from the kube-prometheus-stack
+Together with [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack), you can easily leverage the full potential of the open-source cloud-native observability stack.
+
+Before enabling the following options, you need to install the respective custom resource definitions (CRDs) from the kube-prometheus-stack
 repository or Prometheus operator.
 
 # Defaults
@@ -38,10 +37,10 @@ To deploy `podMonitor` and `serviceMonitor` custom resources, enable it by:
 
 ```yaml
 prometheus:
-  serviceMonitors:
-    enabled: true
-  podMonitors:
-    enabled: true
+  serviceMonitors:
+    enabled: true
+  podMonitors:
+    enabled: true
 ```
 
 # Alerts
@@ -53,23 +52,25 @@ All alert rules are deployed as [PrometheusRule](https://prometheus-operator.dev
 
 ```yaml
 prometheus:
-  prometheusRules:
-    enabled: true
+  prometheusRules:
+    enabled: true
 ```
 
 # Dashboards for Grafana
 
-To deploy optional ConfigMaps with Grafana dashboards, enable it by:
+To deploy optional Grafana dashboards with ConfigMaps, enable the functionality with:
 
 ```yaml
 grafana:
-  dashboards:
-    enabled: true
+  dashboards:
+    enabled: true
 ```
 
-# Components
+Please find further details in the [related Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dashboards).
 
-| Component | Metrics (pod- or serviceMonitor)  | Alerts (prometheusRule) | Dashboard (Grafana) |
-|:----------|-----------------------------------|-------------------------|---------------------|
-| Collabora | :white_check_mark:                | :white_check_mark:      | :white_check_mark:  |
-| Nextcloud | :white_check_mark:                | :x:                     | :x:                 |
+# Component overview
+
+| Component | Metrics (pod- or serviceMonitor) | Alerts (prometheusRule) | Dashboard (Grafana) |
+|:----------|----------------------------------|-------------------------|---------------------|
+| Collabora | :white_check_mark:               | :white_check_mark:      | :white_check_mark:  |
+| Nextcloud | :white_check_mark:               | :x:                     | :x:                 |

docs/permissions.md

@@ -35,31 +35,31 @@ openDesk uses role-based access control (RBAC) to manage permissions. This syste
 
 # Identity and Access Management (IAM)
 
-Within openDesk's Identity and Access Management component Nubus the openDesk user accounts are managed, as well as some core roles and permissions.
+Within openDesk's Identity and Access Management component, Nubus, openDesk user accounts are managed, as well as some core roles and permissions.
 
 ## Permissions
 
 A permission represents a specific authorization that defines an action a user is allowed to perform on a resource.
 
-As openDesk consists of multiple applications, each application may have different needs regarding its fine-grained internal permissions, usually these permissions are manged within each component.
+As openDesk consists of multiple applications, each application may have different needs regarding its fine-grained internal permissions. Usually these permissions are manged within each component.
 
-The overall permissions to access the application as well as group membership of users is managed in the IAM.
+The high-level permissions required to access the application, as well as group membership of users is managed in the IAM.
 
 ## Roles
 
 Roles are defined sets of permissions that can be assigned to users. Each role corresponds to a specific set of tasks and responsibilities within the system. In openDesk's IAM, two roles are defined by default:
 
 - **openDesk Administrator**: Manages openDesk-global settings, such as users and groups.
-- **openDesk User**: Can login to openDesk to make use of defined openDesk applications.
+- **openDesk User**: Can log in to openDesk to make use of defined openDesk applications.
 
 > **Note**<br>
-> It is strongly recommended that a user account is not granted both roles at the same time to address the segregation of duties, though it is not enforced by openDesk.
+> Although it is not enforced by openDesk, it is strongly recommended that a user account is not granted both roles at the same time. This is to maintain the separation of duties.
 
 ### Application usage
 
 To access and use applications in openDesk and to address [the principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege), a user needs to have the necessary permissions set. openDesk defines the following permissions to access applications:
 
-- **Groupware**: Use email, calendar and address book applications.
+- **Groupware**: Use email, calendar, and address book applications.
 - **Chat**: Use the chat application.
 - **Knowledge Management**: Use the wiki application.
 - **Project Management**: Use the project management application.
@@ -76,32 +76,32 @@ For applications that provide application-specific administrative settings, open
 
 ## Groups
 
-Groups help in clustering users with similar responsibilities and enable easier assignment of roles or permissions. It is often the case that a group maps directly to a role.
+Groups help with clustering users with similar responsibilities and make it easier to assign roles or permissions. It is often the case that a group maps directly to a role.
 
-openDesk predefines the following groups.
+openDesk includes predefined groups. Please see below.
 
 ### Global groups
 
 - **Domain Users**: Members of this group are *openDesk Users*.
-- **Domain Admins**: Members of this group are *openDesk IAM Administrators*. By default this group is also enable for two-factor authentication (2FA).
+- **Domain Admins**: Members of this group are *openDesk IAM Administrators*. By default, this group has two-factor authentication (2FA) enabled.
 - **2fa-users**: Members of this group that are forced to use two-factor authentication (2FA).
 - **IAM API - Full Access**: Members of this group have full (read and write) access to the IAM's REST API.
 
 ### Application groups
 
-When editing a user in the IAM you can select if a user can access or get elevated admin permission for a specific application within the "openDesk" tab. The selection is stored as an attribute on the user object, but for other applications it is helpful to also expose the information as a group membership. Therefore openDesk comes with the following [groups](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/blob/main/udm/udm-data-loader/63-groups.yaml).
+When editing a user in the IAM, you can select if a user can access or get elevated admin permission for a specific application within the "openDesk" tab. The selection is stored as an attribute on the user object, but in other applications, it is helpful to also expose this information as a group membership. Therefore, openDesk comes with the following [groups](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/blob/main/udm/udm-data-loader/63-groups.yaml).
 
-To easily identify these groups all of them are prefixed with `managed-by-Attribute-`.
+To easily identify these groups, all of them are prefixed with `managed-by-Attribute-`.
 
 > **Note**<br>
-> The membership of these groups is automatically managed, based on the user's attributes from the "openDesk" tab. So any changes directly to the groups will be overwritten, please always use the "openDesk" of the respective user. The IAM supports to edit user attributes in multiple accounts at once.
+> The membership of these groups is automatically managed based on the user's attributes from the "openDesk" tab. Any changes directly to the groups will be overwritten, so please always use the "openDesk" tab of the respective user. The IAM supports editing user attributes across multiple accounts simultaneously.
 
 #### Standard access to applications
 
-Unless a user is member of a group the respective application is not shown in the portal.
+Unless a user is a member of a group, the respective application is not shown in the portal.
 
 > **Note**<br>
-> In openDesk's identity provider the required OIDC claims to access an application are only granted when the respective group membership is available. So even if a user who is not a member of an application group, knows the link to the application and calls it directly, the single sign-on will not be successful.
+> In openDesk's identity provider, the required OIDC claims to access an application are only granted when the respective group membership is available. This means that even if a user who is not a member of an application group knows the link to the application and calls it directly, the single sign-on will be unsuccessful.
 
 - **managed-by-Attribute-Groupware**: Members of this group have access to the groupware applications.
 - **managed-by-Attribute-Fileshare**: Members of this group have access to the file sharing application.
@@ -128,9 +128,9 @@ Users get roles assigned based on their responsibilities and the tasks they need
 
 ## Predefined roles / user templates
 
-openDesk defines [templates](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/blob/main/udm/udm-data-loader/65-usertemplate.yaml) for the *User* and *Administrator* roles. The templates can be used to create users with these roles by an *openDesk Administrator* using the [administration portal](https://docs.opendesk.eu/administration/).
+openDesk defines [templates](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/blob/main/udm/udm-data-loader/65-usertemplate.yaml) for the *User* and *Administrator* roles. The templates can be used by an *openDesk Administrator* to create users with these roles using the [administration portal](https://docs.opendesk.eu/administration/).
 
-> **Notes**<br>
+> **Note**<br>
 > Additional/custom templates can be created using the UDM REST API.
 
 ### *openDesk User*
@@ -169,34 +169,34 @@ By using roles and permissions, openDesk ensures that users have the appropriate
 
 ## Hierarchies and delegation
 
-The IAM allows the nesting of groups, in that case a group has no or not only users as members but other groups.
+The IAM allows for the nesting of groups, for example, a group can be both assigned to members and other groups, or just groups.
 
 ## Audit/Logging
 
-Univention is about to provide an audit logging which brings the idea of the [UCS based directory logger](https://docs.software-univention.de/manual/5.0/en/domain-ldap/ldap-directory.html#audit-proof-logging-of-ldap-changes) to Nubus. openDesk will offer this feature as soon as it is made available in Nubus.
+Univention is about to provide audit logging which brings the idea of the [UCS based directory logger](https://docs.software-univention.de/manual/5.0/en/domain-ldap/ldap-directory.html#audit-proof-logging-of-ldap-changes) to Nubus. openDesk will offer this feature as soon as it is made available in Nubus.
 
 ## Reporting
 
-The IAM webinterface supports the export of reports for users and groups, which are the essential objects when it comes to permissions. These data exports can be subject to custom data analysis.
+The IAM webinterface supports the export of reports on users and groups, which are the essential objects when it comes to permissions. These data exports can be subjected to custom data analysis.
 
 ## Delegation
 
-Currently the temporary assignment of roles is not supported. Role membership must be managed at the time of granting / revoking the membership.
+Currently, the temporary assignment of roles is not supported. Role membership must be managed at the time of granting / revoking the membership.
 
 ## Regular review
 
-While the overall role and permission setup must be checked by the customer including the respective custom roles, the openDesk team is challenging and improving the role and permission management on a regular basis, e.g. to address the need for a distinct "support" role.
+While the overall role and permission setup must be checked by the customer, including the respective custom roles, the openDesk team constantly challenges and improves role and permission management, for example, addressing the need for a distinct "support" role.
 
 # Applications
 
-As managing all the application permissions within the IAM would require a superset of permissions to be available in the IAM causing a high level of administrative complexity, the permissions are usually managed within an application itself and mapped to roles/groups that are managed in the IAM.
+Managing all application permissions within the IAM would require a superset of permissions to be available in the IAM. This would lead to a high level of administrative complexity. Instead, the application specific permissions are usually managed within an application itself and mapped to roles/groups that are managed in the IAM.
 
 ## Roles/groups
 
-For each IAM group it can be configured for which openDesk application the group should be visible. Like with users this is done in the "openDesk" tab of the [group administration](https://docs.opendesk.eu/administration/gruppen/).
+Within IAM groups, the visibility of openDesk applications can be configured. Like with users, this is done in the "openDesk" tab of the [group administration](https://docs.opendesk.eu/administration/gruppen/).
 
 > **Note**<br>
 > Currently the openDesk applications do not support nested groups. As a result only direct group memberships of users are processed in the application.<br>
 > The plan is to enable the openDesk applications to either support nested groups or to actively provision users into an application while resolving the nested group memberships for the application.
 
-Within an application each available group can get a set of application specific permissions assigned.
+Within an application, each available group can have a set of application specific permissions assigned.

docs/requirements.md

@@ -1,4 +1,5 @@
 <!--
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
@@ -12,38 +13,42 @@ This section covers the internal system requirements and external service requir
 * [Hardware](#hardware)
 * [Kubernetes](#kubernetes)
 * [Ingress controller](#ingress-controller)
+  * [Supported controllers](#supported-controllers)
+  * [Minimal configuration](#minimal-configuration)
 * [Volume provisioner](#volume-provisioner)
 * [Certificate management](#certificate-management)
 * [External services](#external-services)
 * [Deployment](#deployment)
+* [Footnotes](#footnotes)
 <!-- TOC -->
 
 # tl;dr
 
 openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s) cluster.
 
-- K8s cluster >= 1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
+- K8s cluster >= v1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
-- Ingress controller (Ingress NGINX)
+- Ingress controller (Ingress NGINX) >= [4.11.5/1.11.5](https://github.com/kubernetes/ingress-nginx/releases)
 - [Helm](https://helm.sh/) >= v3.9.0
-- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc5**
-- [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
-- Volume provisioner supporting RWO (read-write-once)
+- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= v1.0.0-rc8
+- [HelmDiff](https://github.com/databus23/helm-diff) >= v3.6.0
+- Volume provisioner supporting RWO (read-write-once)[^1]
 - Certificate handling with [cert-manager](https://cert-manager.io/)
+- [OpenKruise](https://openkruise.io/)[^2] >= v1.6
 
 # Hardware
 
-The following minimal requirements are thought for initial evaluation deployment:
+The following minimum requirements are intended for initial evaluation deployment:
 
-| Spec | Value                                                 |
-| ---- | ----------------------------------------------------- |
-| CPU  | 12 Cores of x64 or x86 CPU (ARM is not supported yet) |
-| RAM  | 32 GB, more recommended                               |
-| Disk | HDD or SSD, >10 GB                                    |
+| Spec | Value                                                 |
+|------|-------------------------------------------------------|
+| CPU  | 12 Cores of x64 or x86 CPU (ARM is not supported yet) |
+| RAM  | 32 GB, more recommended                               |
+| Disk | HDD or SSD, >10 GB                                    |
 
 # Kubernetes
 
-Any self-hosted or managed K8s cluster >= 1.24 listed in
+Any self-hosted or managed K8s cluster >= v1.24 listed in
 [CNCF Certified Kubernetes distributions](https://www.cncf.io/certification/software-conformance/) should be supported.
 
 The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/kubespray) based clusters.
@@ -53,14 +58,36 @@ The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/
 
 # Ingress controller
 
-The deployment is intended to be used only over HTTPS via a configured FQDN, therefore it is required to have a proper
-configured ingress controller deployed.
+The deployment is intended to be used only over HTTPS via a configured FQDN, therefore it is required to have a properly
+configured ingress controller deployed in your cluster.
+
+## Supported controllers
 
-**Supported controllers:**
 - [Ingress NGINX Controller](https://github.com/kubernetes/ingress-nginx)
 
 > **Note**<br>
-> The platform development team is evaluating the use of [Gateway API](https://gateway-api.sigs.k8s.io/). If you have feedback on that topic, please share it with us.
+> The platform development team is evaluating the use of [Gateway API](https://gateway-api.sigs.k8s.io/).
+
+**Compatibility with Ingress NGINX >= 1.12.0**
+
+With the release 1.12.0 Ingress NGINX introduced new security default settings, which are incompatible with current openDesk releases. If you want to use Ingress-NGINX >= 1.12.0 the following settings have to be set:
+```
+controller.config.annotations-risk-level=Critical
+controller.config.strict-validate-path-type=false
+```
+See the [`annotations-risk-level` documentation](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#annotations-risk-level) and [`strict-validate-path-type` documentation](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#strict-validate-path-type) for details.
+
+> **Important Note**<br>
+> Ensure to install at least Ingress NGINX 1.11.5 or 1.12.1 due to [security issues](https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities) in earlier versions.
+
+## Minimal configuration
+
+Several components in openDesk make use of snippet annotations, which are disabled by default. Please enable them using the following configuration:
+```
+controller.allowSnippetAnnotations=true
+controller.admissionWebhooks.allowSnippetAnnotations=true
+```
+See the [`allowSnippetAnnotations` documentation](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#allow-snippet-annotations) for context.
 
 # Volume provisioner
 
@@ -68,7 +95,7 @@ Initial evaluation deployment requires a `ReadWriteOnce` volume provisioner. For
 provisioner is sufficient.
 
 > **Note**<br>
-> Some components require a `ReadWriteMany` volume provisioner for distributed mode or scaling.
+> Some components require a `ReadWriteMany` volume provisioner for distributed mode or horizontal scaling.
 
 # Certificate management
 
@@ -76,7 +103,7 @@ This deployment leverages [cert-manager](https://cert-manager.io/) to generate v
 but a secret containing a valid TLS certificate is required.
 
 Only `Certificate` resources will be deployed; the `cert-manager`, including its CRD must be installed before this or
-openDesk certificate management switched off.
+openDesk certificate management is switched off.
 
 # External services
 
@@ -84,23 +111,30 @@ For the development and evaluation of openDesk, we bundle some services. Be awar
 deployments, you need to make use of your own production-grade services; see the
 [external-services.md](./external-services.md) for configuration details.
 
-| Group    | Type                | Version | Tested against        |
-| -------- | ------------------- | ------- | --------------------- |
-| Cache    | Memcached           | `1.6.x` | Memcached             |
-|          | Redis               | `7.x.x` | Redis                 |
-| Database | MariaDB             | `10.x` | MariaDB               |
-|          | PostgreSQL          | `15.x` | PostgreSQL            |
-| Mail     | Mail Transfer Agent |         | Postfix               |
-|          | PKI/CI (S/MIME)     |         |                       |
-| Security | AntiVirus/ICAP      |         | ClamAV                |
-| Storage  | K8s ReadWriteOnce   |         | Ceph / Cloud specific |
-|          | K8s ReadWriteMany   |         | Ceph / NFS            |
-|          | Object Storage      |         | MinIO                 |
-| Voice    | TURN                |         | Coturn                |
+| Group    | Type                | Version | Tested against        |
+|----------|---------------------|---------|-----------------------|
+| Cache    | Memcached           | `1.6.x` | Memcached             |
+|          | Redis               | `7.x.x` | Redis                 |
+| Database | Cassandra[^2]       | `5.0.x` | Cassandra             |
+|          | MariaDB             | `10.x`  | MariaDB               |
+|          | PostgreSQL          | `15.x`  | PostgreSQL            |
+| Mail     | Mail Transfer Agent |         | Postfix               |
+|          | PKI/CI (S/MIME)     |         |                       |
+| Security | AntiVirus/ICAP      |         | ClamAV                |
+| Storage  | K8s ReadWriteOnce   |         | Ceph / Cloud specific |
+|          | K8s ReadWriteMany   |         | Ceph / NFS            |
+|          | Object Storage      |         | MinIO                 |
+| Voice    | TURN                |         | Coturn                |
 
 # Deployment
 
 The deployment of each component is [Helm](https://helm.sh/) based. The 35+ Helm charts are configured and
 templated via [Helmfile](https://helmfile.readthedocs.io/en/latest/) to provide a streamlined deployment experience.
 
-Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare the desired against the deployed state.
+Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare the desired state against the deployed state.
+
+# Footnotes
+
+[^1]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail.
+
+[^2]: Required for Dovecot Pro as part of openDesk Enterprise Edition.

docs/scaling.md

@@ -1,23 +1,39 @@
 <!--
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
 
 <h1>Scaling</h1>
 
-This document covers the ability to scale applications.
+This document covers the possibilities to scale the applications in openDesk.
 
-# Horizontal scalability
+It provides rough benchmarks for configuring your own environment across various scale levels.
+In production, resource demands are primarily driven by actual usage patterns and system load, especially the number of concurrently active users.
+Consequently, we strongly recommend implementing monitoring and logging solutions to detect usage trends and enable timely intervention when needed.
 
-We are working on generating this document automatically based on the file
-[`replicas.yaml.gotmpl`](../helmfile/environments/default/replicas.yaml.gotmpl) that contains necessary annotations.
-In the meantime, this file can be used to check the components scaling support/capabilities.
+| Application  | Recommendation | Note(s) |
+| ------------ | -------------- | ------- |
+| Collabora    | - 1 vCPU per 15 active users <br/> - 50 MB RAM per active user <br/> - 1 MBit/s per 10 active users | - |
+| Element      | Per 10k users with values for federation activated / federation deactivated:<br/><br/> Homeserver:<br/> - 15 / 10 vCPU<br/> - 12 / 8 GB RAM<br/><br/>Postgres:<br/> - 10 / 4 vCPU<br/> - 32 / 16 GB RAM | Required hardware resources are impacted by whether or not federation is being used |
+| Cryptpad     | No large-scale deployments seen, minimum requirements: <br/> - 2 vCPU <br/> - 2 GB RAM <br/> - 20 GB storage (depending on planned usage) | Most of the computation is done client-side |
+| Jitsi        | Jitsi-Meet server: <br/> - 4 vCPU <br/> - 8 GB RAM <br/> <br/> For every 200 concurrent users one JVB with: <br/> - 8 vCPU <br/> - 8 GB RAM <br/><br/> Network bandwidth: <br/> - 1 GBit/s - 10 GBit/s small deployments <br/> - 10 Gbit/s *per bridge* large deployments<br/> | JVB network bandwidth calculation depends on the stream resolution (HD vs. 4k). |
+| Nextcloud    | Up to 5k / more than 5k users: <br/> - 4 to 20 Nextcloud AIO Pods with 8 vCPUs and 32 / 64 GB RAM each <br/> - 2 / 4 DB servers with 8 / 16 vCPUs and 64 / 128 GB RAM each, plus DB load balancer | - |
+| OpenProject  | - 4-6 vCPU per ~500 users <br/> - 6-8 GB per ~500 users <br/> - +20-50 GB storage per ~500 users, depending on workload and attachment storage[^1] <br/><br/> - Web Workers: +4 per ~500 users <br/> - Background Workers: +1-2 multithreaded workers per ~500 users, depending on workload | These values are guidelines and should be adjusted based on actual monitoring of resource usage. Scaling should prioritize CPU and RAM, prioritize scaling Web Workers first, followed by Background Workers and Disk Space as needed. |
+| Open-Xchange | For ~200 users (64 concurrent users to App Suite & 128 users to Dovecot): <br/> - 10 vCPU <br/> - 58 GB RAM <br/> - 660 GB storage | - |
+| XWiki        | Advise for small instances: <br> - 4 vCPU <br/> - 6 GB RAM | - |
+
+[^1]: Nextcloud is configured for attachment storage as well.
 
 # Upstream information
 
 While scaling services horizontally is the ideal solution, information about vertical scaling is helpful
 when defining the application's resources, see [`resources.yaml.gotmpl`](../helmfile/environments/default/resources.yaml.gotmpl) for references.
 
-Please find below links to the application's upstream resources about scaling:
+Linked below is documentation related to scaling for upstream applications, where publically available:
 
-- [OpenProject system requirements](https://www.openproject.org/docs/installation-and-operations/system-requirements/)
+- [Collabora Online Technical Documentation](https://mautic.collaboraoffice.com/asset/60:collabora-online-technical-information-pdf)
+- [OpenProject System Requirements](https://www.openproject.org/docs/installation-and-operations/system-requirements/)
+- [XWiki Performance](https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Performances/)
+- [Element Requirements and Recommendations](https://ems-docs.element.io/books/element-server-suite-documentation-lts-2404/page/requirements-and-recommendations)
+- [Jitsi DevOps Guide (scalable setup)](https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-scalable/), [Jitsi Meet Needs](https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-requirements/)

docs/security-context.md

@@ -1,8 +1,7 @@
 <!--
-SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
-
 <h1>Kubernetes Security Context</h1>
 
 <!-- TOC -->
@@ -63,7 +62,7 @@ containerSecurityContext:
 ## privileged
 
 
-Privileged Pods disable most security mechanisms and must be disallowed.
+Privileged Pods eliminate most security mechanisms and must be disallowed.
 
 ```yaml
 containerSecurityContext:
@@ -93,7 +92,7 @@ containerSecurityContext:
 ## seccompProfile
 
 
-Seccomp profile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.
+The seccompProfile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.
 
 ```yaml
 containerSecurityContext:
@@ -113,7 +112,7 @@ containerSecurityContext:
 ## readOnlyRootFilesystem
 
 
-Containers should have an immutable file systems, so that attackers could not modify application code or download malicious code.
+Containers should have an immutable file systems, so that attackers can not modify application code or download malicious code.
 
 ```yaml
 containerSecurityContext:
@@ -133,10 +132,10 @@ containerSecurityContext:
 # Status quo
 
 
-openDesk aims to achieve that all security relevant settings are explicitly templated and comply with security recommendations.
+openDesk aims to ensure that all security relevant settings are explicitly templated and comply with security recommendations.
 
 
-The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are also properly templated by the given Helm charts.
+The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are properly templated by the Helm charts.
 
 
 This list gives you an overview of templated security settings and if they comply with security standards:
@@ -144,11 +143,11 @@ This list gives you an overview of templated security settings and if they compl
 
  - **yes**: Value is set to `true`
  - **no**: Value is set to `false`
- - **n/a**: No explicitly templated in openDesk and default is used.
+ - **n/a**: Not explicitly templated in openDesk; default is used.
 
 | process | status | allowPrivilegeEscalation | privileged | readOnlyRootFilesystem | runAsNonRoot | runAsUser | runAsGroup | seccompProfile | capabilities |
 | ------- | ------ | ------------------------ | ---------- | ---------------------- | ------------ | --------- | ---------- | -------------- | ------------ |
-| **collabora**/collabora-online | :x: | yes | no | no | yes | 100 | 101 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT","MKNOD"] |
+| **collabora**/collabora-online | :x: | yes | no | no | yes | 1001 | 1001 | yes | no ["CHOWN","FOWNER","SYS_CHROOT"] |
 | **cryptpad**/cryptpad | :x: | no | no | no | yes | 4001 | 4001 | yes | yes |
 | **element**/matrix-neoboard-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/matrix-neochoice-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
@@ -156,7 +155,7 @@ This list gives you an overview of templated security settings and if they compl
 | **element**/matrix-neodatefix-bot-bootstrap | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/matrix-neodatefix-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/opendesk-element | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
-| **element**/opendesk-matrix-user-verification-service | :x: | no | no | no | no | 0 | 0 | yes | yes |
+| **element**/opendesk-matrix-user-verification-service | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **element**/opendesk-matrix-user-verification-service-bootstrap | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/opendesk-synapse | :white_check_mark: | no | no | yes | yes | 10991 | 10991 | yes | yes |
 | **element**/opendesk-synapse-web | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
@@ -169,10 +168,36 @@ This list gives you an overview of templated security settings and if they compl
 | **jitsi**/jitsi/jitsi/prosody | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/jitsi/web | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/patchJVB | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 65532 | 65532 | yes | yes |
-| **nextcloud**/opendesk-nextcloud/apache2 | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
+| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 101 | 101 | yes | yes |
+| **nextcloud**/opendesk-nextcloud/aio | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **nextcloud**/opendesk-nextcloud/exporter | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
-| **nextcloud**/opendesk-nextcloud/php | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
+| **notes**/impress/backend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **notes**/impress/frontend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **notes**/impress/yProvider | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **nubus**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/intercom-service/provisioning | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/keycloak | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/authorizationApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/managementApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/managementUi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/openPolicyAgent | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusKeycloakBootstrap | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusKeycloakExtensions/handler | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusKeycloakExtensions/proxy | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusLdapNotifier | :x: | no | n/a | yes | yes | 101 | 102 | yes | yes |
+| **nubus**/ums/nubusNotificationsApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusPortalConsumer | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusPortalFrontend | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusPortalServer | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusProvisioning | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusProvisioning/nats | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusSelfServiceConsumer | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusStackDataUms | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusUdmListener | :x: | no | n/a | yes | yes | 102 | 65534 | yes | yes |
+| **nubus**/ums/nubusUdmRestApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusUmcGateway | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusUmcServer | :x: | no | n/a | yes | no | 0 | 0 | yes | yes |
 | **open-xchange**/dovecot | :x: | no | n/a | yes | n/a | n/a | n/a | yes | no ["CHOWN","DAC_OVERRIDE","KILL","NET_BIND_SERVICE","SETGID","SETUID","SYS_CHROOT"] |
 | **open-xchange**/open-xchange/appsuite/core-documentconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/appsuite/core-guidedtours | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
@@ -184,34 +209,27 @@ This list gives you an overview of templated security settings and if they compl
 | **open-xchange**/open-xchange/appsuite/guard-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/nextcloud-integration-ui | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/opendesk-open-xchange-bootstrap | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/postfix-ox | :x: | yes | yes | yes | no | 0 | 0 | yes | no |
+| **opendesk-migrations-post**/opendesk-migrations-post | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-migrations-pre**/opendesk-migrations-pre | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-services**/opendesk-static-files | :x: | no | n/a | yes | yes | 101 | 101 | yes | yes |
 | **openproject**/openproject | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **open-xchange**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **services**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
-| **services**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services**/minio | :x: | no | no | no | yes | 1000 | 0 | yes | yes |
-| **services**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
-| **services**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **univention-management-stack**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak-extensions/handler | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak-extensions/proxy | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/ldap-notifier | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
-| **univention-management-stack**/ums/portal-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums/selfservice-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums/stack-data-swp | :x: | no | no | no | no | 0 | 0 | yes | yes |
-| **univention-management-stack**/ums/stack-gateway | :x: | no | no | no | yes | 1001 | 0 | yes | yes |
-| **univention-management-stack**/ums/umc-gateway | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums/umc-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **services-external**/cassandra | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
+| **services-external**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/minio | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/opendesk-dkimpy-milter | :x: | yes | no | yes | yes | 1000 | 1000 | yes | no |
+| **services-external**/postfix | :x: | yes | yes | yes | no | 0 | 0 | yes | no |
+| **services-external**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **xwiki**/xwiki | :x: | no | no | no | yes | 100 | 101 | yes | yes |
 
 

docs/security.md

@@ -5,7 +5,7 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>Security</h1>
 
-This document should cover the current status of security measurements.
+This document covers the current status of security measures.
 
 <!-- TOC -->
 * [Helm Chart Trust Chain](#helm-chart-trust-chain)
@@ -21,21 +21,21 @@ For more details on Chart validation, please visit: https://helm.sh/docs/topics/
 
 All charts except the ones mentioned below are verifiable:
 
-| Repository        | Verifiable |
+| Repository        | Verifiable |
 |-------------------|:----------:|
-| open-xchange-repo |     no     |
+| open-xchange-repo |     no     |
 
 # Kubernetes Security Enforcements
 
 This list gives you an overview of default security settings and whether they comply with security standards:
 
-⟶ Visit our generated detailed [Security Context](./security-context.md) overview.
+⟶ Visit our generated detailed [Security Context](./docs/security-context.md) overview.
 
 # NetworkPolicies
 
 Kubernetes NetworkPolicies are an essential measure to secure your Kubernetes apps and clusters.
-When applied, they restrict the traffic to your services.
-This protects other deployments in your cluster or other services in your deployment from getting compromised when one
+When applied, they restrict traffic to your services.
+NetworkPolicies protect other deployments in your cluster or other services in your deployment from getting compromised when another
 component is compromised.
 
 We ship a default set of Otterize ClientIntents via
@@ -46,6 +46,6 @@ This requires the Otterize intents operator to be installed.
 
 ```yaml
 security:
-  otterizeIntents:
-    enabled: true
+  otterizeIntents:
+    enabled: true
 ```

docs/testing.md

@@ -0,0 +1,153 @@
+<!--
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Testing</h1>
+
+<!-- TOC -->
+* [Overview](#overview)
+* [Test concept](#test-concept)
+  * [Rely on upstream applications QA](#rely-on-upstream-applications-qa)
+  * [Functional QA (end-to-end tests)](#functional-qa-end-to-end-tests)
+    * [Nightly testing](#nightly-testing)
+    * [Reporting test results](#reporting-test-results)
+  * [Load- and performance testing](#load--and-performance-testing)
+    * [Base performance testing](#base-performance-testing)
+    * [Load testing to saturation point](#load-testing-to-saturation-point)
+    * [Load testing up to a defined user count](#load-testing-up-to-a-defined-user-count)
+    * [Overload/recovery tests](#overloadrecovery-tests)
+<!-- TOC -->
+
+# Overview
+
+The following section provides an overview of the testing approach adopted to ensure the quality and reliability of openDesk. This concept balances leveraging existing quality assurance (QA) processes with targeted testing efforts tailored to the specific needs of openDesk. The outlined strategy focuses on three key areas:
+
+1. Relying on application QA: Utilizing the existing QA processes of the applications to ensure baseline functionality and quality standards.
+2. Minimal functional QA: Executing end-to-end tests to validate critical workflows and ensure that key functionalities operate as expected.
+3. Extensive load and performance testing: Conducting comprehensive load and performance tests to assess openDesk's scalability and responsiveness under varying usage conditions.
+
+These efforts are designed to complement each other, minimizing redundancy while ensuring robust testing coverage.
+
+# Test concept
+
+## Rely on upstream applications QA
+
+openDesk contains applications from different suppliers. As a general approach, we rely on the testing
+conducted by these suppliers for their respective applications.
+
+We review the supplier's QA measures on a regular basis, to ensure a reliable and sufficient QA of the underlying applications.
+
+We receive the release notes early before a new application release is integrated into openDesk, so
+we are able to check for the existence of a sufficient set of test cases.
+The suppliers create a set of test cases for each new function.
+
+## Functional QA (end-to-end tests)
+
+We develop and maintain a [set of end-to-end tests](https://gitlab.opencode.de/bmi/opendesk/deployment/e2e-tests) focussing on:
+
+- use cases that are spanning more than a single application, e.g.
+  - the filepicker in OX App Suite for selecting files from Nextcloud or
+  - the central navigation that is part of the top bar of most applications.
+- openDesk specific configurations/supported settings that can be found in the `functional.yaml.gotmpl`, e.g.
+  - SSO federation or
+  - sharing settings for Nextcloud.
+- bugs identified in the past, e.g.
+  - creating a folder in OX or
+  - enforcement of an account's password renewal.
+
+We execute the tests using English and German as language profile.
+
+The development team utilizes the test automation described above for QA'ing their feature branches.
+
+### Nightly testing
+
+We use the functional e2e-tests in nightly testruns on a matrix of deployments addressing different application profiles to ensure the quality of the development branch's current state.
+
+The following naming scheme is applied for the deployment matrix:
+
+- `<edition>-<type>-<profile>` resulting e.g. in  `ce-init-default` or `ee-upgr-extsrv`
+
+**`<edition>`**
+
+- `ce`: openDesk Community Edition
+- `ee`: openDesk Enterprise Edition
+
+**`<type>`**
+
+- `init`: Initial / fresh / from the scratch deployment of `develop` branch into an empty namespace.
+- `upgr`: Deploy latest migration release (needs to be pinned manually) into an empty namespace, afterwards run upgrade deployment with current state of `develop` branch.
+- `upd`: Deploy latest release (`main` branch) into an empty namespace, afterwards run upgrade deployment with current state of `develop` branch.
+
+**`<profile>`**: The following profiles are defined
+- `default`: With
+  - *`functional.yaml`*: No changes beside specific `2FA testing` group and enabled UDM REST API (required for user import).
+  - *Services*: Internal services deployed with openDesk are used.
+  - *Secrets*: Master password based secrets based on `secrets.yaml.gotmpl`
+  - *Certificates*: Letsencrypt-prod certificates are used.
+  - *Deployment*: GitLab CI based deployment.
+- `funct1`: Different configuration of `functional.yaml`, self-signed-certs [and when available external secrets].
+- `extsrv`: External services (where possible).
+- `gitops`: Argo CD based deployment.
+
+### Reporting test results
+
+All executions of the end-to-end tests are tracked in a central platform running [Allure TestOps](https://docs.qameta.io/allure-testops/).
+
+As the TestOps tool contains infrastructure details of our development and test clusters it is currently only accessible for to project members.
+
+## Load- and performance testing
+
+Our goal is to deliver openDesk as application-grade software with the ability to serve large user bases.
+
+We create and perform [load- and performance tests](https://gitlab.opencode.de/bmi/opendesk/deployment/load-tests) for each release of openDesk.
+
+Our approach consists of different layers of load testing.
+
+### Base performance testing
+
+For these tests we define a set of "normal", uncomplicated user-interactions with openDesk.
+
+For each testcase in this set, we measure the duration of the whole testcase (and individual steps within the
+testcase) on a given, unloaded environment, prepared with a predefined setup and openDesk release installed.
+
+As a result, we receive the total runtime of one iteration of the given testcase, the runtime of each
+step inside the testcase, the error rate and min/max/median runtimes.
+
+Most importantly, the environment should not be used by other users or have running background tasks, so it should
+be an environment in a mostly idle state.
+
+The results can be compared with the results of the previous release, so we can see if changes
+in software components improve or decrease the performance of a testcase.
+
+### Load testing to saturation point
+
+These tests are performed to ensure the correct processing and user interaction, even under
+high-load scenarios.
+
+We use the same test cases as in the base performance tests.
+
+Now we measure the duration on a well-defined environment while the system is being used
+by a predefined number of test users in parallel. The number of users is incrementally scaled up.
+
+Our goal is to see constant runtimes of each testcase iteration, despite the increased overall throughput due to the increasing number of parallel users.
+
+At a certain point, increasing the number of users does not lead to higher overall throughput, but instead leads to an increase in the runtime of each testcase iteration.
+
+This point, the saturation point, is the load limit of the environment. Up to this point, the
+environment and the installed software packages can handle the load. Beyond this point, response times increase and error rates rise.
+
+### Load testing up to a defined user count
+
+For partners interested in large scale openDesk deployments,
+we offer a tailored workshop in which we define scenarios and perform load testing analysis.
+
+This way, we can help you decide on the appropriate sizing for the planned openDesk deployment.
+
+### Overload/recovery tests
+
+If necessary, we perform overload tests, which will saturate the system with multiple
+test cases until no further increase in throughput is visible. Then we add even more load
+until the first HTTP requests run into timeouts or errors.
+After a few minutes, we reduce the load below the saturation point.
+Now we can check if the system is able to recover from the overload status.

docs/theming.md

@@ -14,17 +14,12 @@ This document covers the theming options for an openDesk deployment.
 
 # Settings
 
-All default settings can be found in the [`theme.gotmpl`](../helmfile/environments/default/theme.gotmpl). Most of the components adhere to these settings.
+All default settings can be found in [`theme.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl). Most of the components adhere to these settings.
 
 Please review the default configuration that is applied to understand your customization options.
 
-You can just update the files in:
-- [helmfile/files/theme](../helmfile/files/theme): To change logos, favicons etc.
-- [helmfile/files/portal-tiles](../helmfile/files/portal-tiles): To change the icons in the portal.
+You can just update the files in [helmfile/files/theme](../helmfile/files/theme) to change logos, favicons etc. Note that the `.svg` versions of the favicons are also used for the portal tiles.
 
 # Known limitations
 
-Not all applications support theming. Known exceptions are:
-- OpenProject, comes with a build in openDesk theming that can be modified in the Enterprise version's OpenProject web interface.
-- The portal background logo can (currently) only be set on initial deployment.
-- Portal and Keycloak screen styles must be applied in the [`portalStylesheets.css`](../helmfile/files/theme/portalStylesheet.css).
+- Portal and Keycloak screen styles, especially colors, must be applied in the [`portalStylesheets.css`](../helmfile/files/theme/portalStylesheet.css),

helmfile/apps/collabora/helmfile-child.yaml.gotmpl

@@ -10,7 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
 
   # Collabora Controller - Enterprise Only
   # Source: https://github.com/CollaboraOnline/online
@@ -20,7 +20,7 @@ repositories:
     username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.collaboraController.registry }}/{{ .Values.charts.collaboraController.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.collaboraController.registry }}/{{ .Values.charts.collaboraController.repository }}"
 
 releases:
   - name: "collabora-online"
@@ -28,24 +28,24 @@ releases:
     version: "{{ .Values.charts.collabora.version }}"
     values:
       - "values.yaml.gotmpl"
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
       - "values-enterprise.yaml.gotmpl"
       {{- end }}
       {{- range .Values.customization.release.collaboraOnline }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.collabora.enabled }}
+    installed: {{ .Values.apps.collabora.enabled }}
   - name: "collabora-controller"
     chart: "collabora-controller-repo/{{ .Values.charts.collaboraController.name }}"
     version: "{{ .Values.charts.collaboraController.version }}"
     values:
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
       - "values-coco-enterprise.yaml.gotmpl"
       {{- end }}
       {{- range .Values.customization.release.collaboraController }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.collaboraController.enabled }}
+    installed: {{ .Values.apps.collaboraController.enabled }}
 
 commonLabels:
   deployStage: "050-components"

helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl

@@ -12,7 +12,7 @@ controller:
   # Therefore we use the default of `collabora-online` for the `resourceName`
   resourceName: "collabora-online"
   statsInterval: 2000
-  watchNamespace: {{ (.Values.collabora.namespace | default .Release.Namespace | quote) }}
+  watchNamespace: {{ (.Values.apps.collabora.namespace | default .Release.Namespace | quote) }}
 
   documentMigrator:
     enabled: true
@@ -25,6 +25,7 @@ controller:
 image:
   repository: "{{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.collaboraController.registry }}/{{ .Values.images.collaboraController.repository }}"
   tag: {{ .Values.images.collaboraController.tag | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 imagePullSecrets:
   {{- range .Values.global.imagePullSecrets }}
   - name: {{ . | quote }}
@@ -32,14 +33,21 @@ imagePullSecrets:
 
 ingress:
   enabled: {{ .Values.ingress.enabled }}
+  annotations:
+    {{ .Values.annotations.coco.ingress | toYaml | nindent 4 }}
   className: {{ .Values.ingress.ingressClassName | quote }}
   hosts:
     - host: "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
       paths:
         - path: "/controller"
           pathType: "Prefix"
+  tls:
+    - secretName: {{ .Values.ingress.tls.secretName | quote }}
+      hosts:
+        - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.coco.pod | toYaml | nindent 2 }}
 
 securityContext:
   allowPrivilegeEscalation: false
@@ -60,4 +68,7 @@ replicaCount: {{ .Values.replicas.collaboraController }}
 resources:
   {{ .Values.resources.collaboraController | toYaml | nindent 2 }}
 
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.coco.serviceAccount | toYaml | nindent 4 }}
 ...

helmfile/apps/collabora/values-enterprise.yaml.gotmpl

@@ -6,7 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 image:
   repository: "{{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
 autoscaling:
-  enabled: {{ .Values.collaboraController.enabled }}
+  enabled: {{ .Values.apps.collaboraController.enabled }}
   minReplicas: {{ .Values.enterpriseFeatures.collabora.autoscaling.minReplicas }}
   maxReplicas: {{ .Values.enterpriseFeatures.collabora.autoscaling.maxReplicas }}
   targetMemoryUtilizationPercentage: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetMemoryUtilizationPercentage }}

helmfile/apps/collabora/values.yaml.gotmpl

@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -27,7 +27,10 @@ collabora:
     {{- else }}
     --o:logging.anonymize.anonymize_user_data=true
     {{- end }}
-    {{- if .Values.collaboraController.enabled }}
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    --o:user_interface.use_integration_theme=false
+    {{- end }}
+    {{- if .Values.apps.collaboraController.enabled }}
     --o:indirection_endpoint.url=https://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/routeToken
     --o:monitors.monitor[0]=wss://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/ws
     --o:monitors.monitor[0][@retryInterval]=5
@@ -49,7 +52,7 @@ imagePullSecrets:
 
 ingress:
   annotations:
-    {{- if .Values.collaboraController.enabled }}
+    {{- if .Values.apps.collaboraController.enabled }}
     nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_RouteToken"
     {{- else }}
     nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_WOPISrc"
@@ -62,6 +65,35 @@ ingress:
       location /cool/getMetrics { deny all; return 403; }
       location /cool/adminws/ { deny all; return 403; }
       location /browser/dist/admin/admin.html { deny all; return 403; }
+    # NGINX
+    nginx.org/websocket-services: "collabora"
+    nginx.org/lb-method: "hash $arg_WOPISrc consistent"
+    nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}s"
+    nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}s"
+    nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.collabora }}"
+    nginx.org/server-snippets: |
+      # block admin and metrics endpoint from outside by default
+      location /cool/getMetrics { deny all; return 403; }
+      location /cool/adminws/ { deny all; return 403; }
+      location /browser/dist/admin/admin.html { deny all; return 403; }
+    # HAProxy
+    haproxy.org/timeout-tunnel: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}s"
+    haproxy.org/backend-config-snippet: |
+       balance url_param WOPISrc check_post
+       hash-type consistent
+    # HAProxy - Community: https://haproxy-ingress.github.io/
+    haproxy-ingress.github.io/timeout-tunnel: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}s"
+    haproxy-ingress.github.io/balance-algorithm: "url_param WOPISrc check_post"
+    haproxy-ingress.github.io/config-backend: |
+      hash-type consistent
+      # block admin urls from outside
+      acl admin_url path_beg /cool/getMetrics
+      acl admin_url path_beg /cool/adminws/
+      acl admin_url path_beg /browser/dist/admin/admin.html
+      http-request deny if admin_url
+   {{- with .Values.annotations.collabora.ingress }}
+   {{ . | toYaml | nindent 4 }}
+   {{- end }}
   enabled: {{ .Values.ingress.enabled }}
   className: {{ .Values.ingress.ingressClassName | quote }}
   hosts:
@@ -74,10 +106,11 @@ ingress:
       hosts:
         - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.collabora.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
-  fsGroup: 100
+  fsGroup: 1001
 
 prometheus:
   servicemonitor:
@@ -99,8 +132,8 @@ securityContext:
   privileged: false
   readOnlyRootFilesystem: false
   runAsNonRoot: true
-  runAsUser: 100
-  runAsGroup: 101
+  runAsUser: 1001
+  runAsGroup: 1001
   seccompProfile:
     type: "RuntimeDefault"
   capabilities:
@@ -113,6 +146,13 @@ securityContext:
 
   seLinuxOptions:
     {{ .Values.seLinuxOptions.collabora | toYaml | nindent 4 }}
+
 serviceAccount:
   create: true
+  annotations:
+    {{ .Values.annotations.collabora.serviceAccount | toYaml | nindent 4 }}
+
+service:
+  annotations:
+    {{ .Values.annotations.collabora.service | toYaml | nindent 4 }}
 ...

helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl

@@ -10,7 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
 
 releases:
   - name: "cryptpad"
@@ -21,7 +21,7 @@ releases:
       {{- range .Values.customization.release.cryptpad }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.cryptpad.enabled }}
+    installed: {{ .Values.apps.cryptpad.enabled }}
 
 commonLabels:
   deployStage: "050-components"

helmfile/apps/cryptpad/values.yaml.gotmpl

@@ -39,6 +39,9 @@ ingress:
   enabled: {{ .Values.ingress.enabled }}
   annotations:
     nginx.org/websocket-services: "cryptpad"
+   {{- with .Values.annotations.cryptpad.ingress }}
+   {{ . | toYaml | nindent 4 }}
+   {{- end }}
   className: {{ .Values.ingress.ingressClassName | quote }}
   hosts:
     - host: "{{ .Values.global.hosts.cryptpad }}.{{ .Values.global.domain }}"
@@ -53,7 +56,8 @@ ingress:
 persistence:
   enabled: false
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.cryptpad.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   fsGroup: 4001
@@ -80,6 +84,8 @@ securityContext:
 
 serviceAccount:
   create: true
+  annotations:
+    {{ .Values.annotations.cryptpad.serviceAccount | toYaml | nindent 4 }}
 
 workloadStateful: false
 

helmfile/apps/element/helmfile-child.yaml.gotmpl

@@ -10,35 +10,35 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
   - name: "element-well-known-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.elementWellKnown.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
   - name: "synapse-web-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapseWeb.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
   - name: "synapse-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapse.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
   - name: "synapse-create-account-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapseCreateAccount.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
 
   # openDesk Matrix Widgets
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
@@ -48,35 +48,35 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
   - name: "matrix-neoboard-widget-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
   - name: "matrix-neochoice-widget-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
   - name: "matrix-neodatefix-widget-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
   - name: "matrix-neodatefix-bot-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
 
   # openDesk Enterprise Repositories
 
@@ -88,28 +88,28 @@ repositories:
     username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
   - name: "synapse-adminbot-web-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapseAdminbotWeb.verify }}
     username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
   - name: "synapse-groupsync-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapseGroupsync.verify }}
     username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
   - name: "synapse-pipe-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.synapsePipe.verify }}
     username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"
 
 releases:
   - name: "opendesk-element"
@@ -120,7 +120,7 @@ releases:
       {{- range .Values.customization.release.opendeskElement }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
     timeout: 900
 
   - name: "opendesk-well-known"
@@ -131,7 +131,7 @@ releases:
       {{- range .Values.customization.release.opendeskWellKnown }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
     timeout: 900
 
   - name: "opendesk-synapse-web"
@@ -142,7 +142,7 @@ releases:
       {{- range .Values.customization.release.opendeskSynapseWeb }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
     timeout: 900
 
   - name: "opendesk-synapse"
@@ -153,7 +153,7 @@ releases:
       {{- range .Values.customization.release.opendeskSynapse }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.element.enabled }}
+    installed: {{ .Values.apps.element.enabled }}
     timeout: 900
 
   - name: "opendesk-matrix-user-verification-service-bootstrap"
@@ -161,7 +161,10 @@ releases:
     version: "{{ .Values.charts.synapseCreateAccount.version }}"
     values:
       - "values-matrix-user-verification-service-bootstrap.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixUserVerificationServiceBootstrap }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
     timeout: 900
 
   - name: "opendesk-matrix-user-verification-service"
@@ -169,7 +172,10 @@ releases:
     version: "{{ .Values.charts.matrixUserVerificationService.version }}"
     values:
       - "values-matrix-user-verification-service.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixUserVerificationService }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
     timeout: 900
 
   - name: "matrix-neoboard-widget"
@@ -177,15 +183,21 @@ releases:
     version: "{{ .Values.charts.matrixNeoboardWidget.version }}"
     values:
       - "values-matrix-neoboard-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixNeoboardWidget }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
     timeout: 900
 
   - name: "matrix-neochoice-widget"
-    chart: "matrix-neochoice-widget-repo/{{ .Values.charts.matrixNeochoiseWidget.name }}"
-    version: "{{ .Values.charts.matrixNeochoiseWidget.version }}"
+    chart: "matrix-neochoice-widget-repo/{{ .Values.charts.matrixNeochoiceWidget.name }}"
+    version: "{{ .Values.charts.matrixNeochoiceWidget.version }}"
     values:
       - "values-matrix-neochoice-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixNeochoiceWidget }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
     timeout: 900
 
   - name: "matrix-neodatefix-widget"
@@ -193,7 +205,10 @@ releases:
     version: "{{ .Values.charts.matrixNeodatefixWidget.version }}"
     values:
       - "values-matrix-neodatefix-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixNeodatefixWidget }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
     timeout: 900
 
   - name: "matrix-neodatefix-bot-bootstrap"
@@ -201,7 +216,10 @@ releases:
     version: "{{ .Values.charts.synapseCreateAccount.version }}"
     values:
       - "values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixNeodatefixBotBootstrap }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
     timeout: 900
 
   - name: "matrix-neodatefix-bot"
@@ -209,7 +227,10 @@ releases:
     version: "{{ .Values.charts.matrixNeodatefixBot.version }}"
     values:
       - "values-matrix-neodatefix-bot.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixNeodatefixBot }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
     timeout: 900
 
   # openDesk Enterprise Releases
@@ -221,7 +242,7 @@ releases:
       {{- range .Values.customization.release.opendeskSynapseAdmin }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
     timeout: 900
 
   - name: "opendesk-synapse-adminbot-bootstrap"
@@ -232,7 +253,7 @@ releases:
       {{- range .Values.customization.release.opendeskSynapseAdminbotBootstrap }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
     timeout: 900
 
   - name: "opendesk-synapse-adminbot-pipe"
@@ -243,7 +264,7 @@ releases:
       {{- range .Values.customization.release.opendeskSynapseAdminbotPipe }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
     timeout: 900
 
   - name: "opendesk-synapse-adminbot-web"
@@ -254,7 +275,7 @@ releases:
       {{- range .Values.customization.release.opendeskSynapseAdminbotWeb }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
     timeout: 900
 
   - name: "opendesk-synapse-auditbot-bootstrap"
@@ -265,7 +286,7 @@ releases:
       {{- range .Values.customization.release.opendeskSynapseAuditbotBootstrap }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
     timeout: 900
 
   - name: "opendesk-synapse-auditbot-pipe"
@@ -276,7 +297,7 @@ releases:
       {{- range .Values.customization.release.opendeskSynapseAuditbotPipe }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
     timeout: 900
 
   - name: "opendesk-synapse-groupsync"
@@ -287,7 +308,7 @@ releases:
       {{- range .Values.customization.release.opendeskSynapseGroupsync }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.elementGroupsync.enabled }}
+    installed: {{ .Values.apps.elementGroupsync.enabled }}
     timeout: 900
 
 commonLabels:

helmfile/apps/element/values-element.yaml.gotmpl

@@ -4,6 +4,9 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+commonAnnotations:
+  {{ .Values.annotations.element.common | toYaml | nindent 2 }}
+
 configuration:
   endToEndEncryption: true
   additionalConfiguration:
@@ -136,8 +139,11 @@ ingress:
   tls:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.element.ingress | toYaml | nindent 4 }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.element.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -148,6 +154,14 @@ replicaCount: {{ .Values.replicas.element }}
 resources:
   {{ .Values.resources.element | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.element.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.element.serviceAccount | toYaml | nindent 4 }}
+
 theme:
   title: "Chat - {{ .Values.theme.texts.productName }}"
   {{ .Values.theme | toYaml | nindent 2 }}

helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl

@@ -4,6 +4,9 @@ SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+additionalAnnotations:
+  {{ .Values.annotations.elementMatrixNeoboardWidget.additional | toYaml | nindent 2 }}
+
 containerSecurityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -39,8 +42,11 @@ ingress:
   tls:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.elementMatrixNeoboardWidget.ingress | toYaml | nindent 4 }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.elementMatrixNeoboardWidget.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -51,6 +57,14 @@ replicaCount: {{ .Values.replicas.matrixNeoBoardWidget }}
 resources:
   {{ .Values.resources.matrixNeoBoardWidget | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.elementMatrixNeoboardWidget.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementMatrixNeoboardWidget.serviceAccount | toYaml | nindent 4 }}
+
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}
 

helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl

@@ -4,6 +4,9 @@ SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+additionalAnnotations:
+  {{ .Values.annotations.elementMatrixNeochoiceWidget.additional | toYaml | nindent 2 }}
+
 containerSecurityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -39,8 +42,11 @@ ingress:
   tls:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.elementMatrixNeochoiceWidget.ingress | toYaml | nindent 4 }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.elementMatrixNeochoiceWidget.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -48,6 +54,14 @@ podSecurityContext:
 
 replicaCount: {{ .Values.replicas.matrixNeoChoiceWidget }}
 
+service:
+  annotations:
+    {{ .Values.annotations.elementMatrixNeochoiceWidget.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementMatrixNeochoiceWidget.serviceAccount | toYaml | nindent 4 }}
+
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}
 

helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl

@@ -26,7 +26,8 @@ image:
 
 fullnameOverride: "matrix-neodatefix-bot-bootstrap"
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.elementMatrixNeodatefixBotBootstrap.pod | toYaml | nindent 2 }}
 
 securityContext:
   allowPrivilegeEscalation: false
@@ -43,4 +44,7 @@ securityContext:
   seLinuxOptions:
     {{ .Values.seLinuxOptions.synapseCreateUser | toYaml | nindent 4 }}
 
+podAnnotations:
+  {{ .Values.annotations.elementMatrixNeodatefixBotBootstrap.serviceAccount | toYaml | nindent 2 }}
+
 ...

helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl

@@ -4,6 +4,9 @@ SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+additionalAnnotations:
+  {{ .Values.annotations.elementMatrixNeodatefixBot.additional | toYaml | nindent 2 }}
+
 global:
   domain: {{ .Values.global.domain | quote }}
   hosts:
@@ -76,6 +79,8 @@ ingress:
   tls:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.elementMatrixNeodatefixBot.ingress | toYaml | nindent 4 }}
 
 liveness sample:
   enabled: true
@@ -83,8 +88,11 @@ liveness sample:
 persistence:
   size: {{ .Values.persistence.storages.matrixNeoDateFixBot.size | quote }}
   storageClass: {{ coalesce .Values.persistence.storages.matrixNeoDateFixBot.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  annotations:
+    {{ .Values.annotations.elementMatrixNeodatefixBot.persistence | toYaml | nindent 4 }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.elementMatrixNeodatefixBot.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -98,4 +106,12 @@ replicaCount: {{ .Values.replicas.matrixNeoDateFixBot }}
 resources:
   {{ .Values.resources.matrixNeoDateFixBot | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.elementMatrixNeodatefixBot.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementMatrixNeodatefixBot.serviceAccount | toYaml | nindent 4 }}
+
 ...

helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl

@@ -4,6 +4,9 @@ SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+additionalAnnotations:
+  {{ .Values.annotations.elementMatrixNeodatefixWidget.additional | toYaml | nindent 2 }}
+
 configuration:
   bot:
     username: "meetings-bot"
@@ -44,8 +47,11 @@ ingress:
   tls:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.elementMatrixNeodatefixWidget.ingress | toYaml | nindent 4 }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.elementMatrixNeodatefixWidget.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -59,6 +65,14 @@ resources:
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.elementMatrixNeodatefixWidget.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementMatrixNeodatefixWidget.serviceAccount | toYaml | nindent 4 }}
+
 nginx:
   ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
 

helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl

@@ -26,7 +26,8 @@ image:
 
 fullnameOverride: "opendesk-matrix-user-verification-service-bootstrap"
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.elementMatrixUserVerificationServiceBootstrap.pod | toYaml | nindent 2 }}
 
 securityContext:
   allowPrivilegeEscalation: false
@@ -42,4 +43,10 @@ securityContext:
     type: "RuntimeDefault"
   seLinuxOptions:
     {{ .Values.seLinuxOptions.synapseCreateUser | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementMatrixUserVerificationServiceBootstrap.serviceAccount | toYaml | nindent 4 }}
+
+
 ...

helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl

@@ -4,6 +4,9 @@ SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+additionalAnnotations:
+  {{ .Values.annotations.elementMatrixUserVerificationService.additional | toYaml | nindent 2 }}
+
 containerSecurityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -12,9 +15,9 @@ containerSecurityContext:
   enabled: true
   privileged: false
   readOnlyRootFilesystem: false
-  runAsGroup: 0
-  runAsNonRoot: false
-  runAsUser: 0
+  runAsGroup: 1000
+  runAsNonRoot: true
+  runAsUser: 1000
   seccompProfile:
     type: "RuntimeDefault"
   seLinuxOptions:
@@ -42,7 +45,8 @@ image:
   repository: {{ .Values.images.matrixUserVerificationService.repository | quote }}
   tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.elementMatrixUserVerificationService.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -53,4 +57,12 @@ replicaCount: {{ .Values.replicas.matrixUserVerificationService }}
 resources:
   {{ .Values.resources.matrixUserVerificationService | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.elementMatrixUserVerificationService.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementMatrixUserVerificationService.serviceAccount | toYaml | nindent 4 }}
+
 ...

helmfile/apps/element/values-synapse-admin.yaml.gotmpl

@@ -45,13 +45,12 @@ configuration:
   homeserver:
     # -- URL of synapse deployment. As default the url of synapse will be used.
     #baseUrl: ""
-  homeserver:
     serverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
   ldap:
     base: {{ .Values.ldap.baseDn | quote }}
-    bind_dn: "uid=ldapsearch_element,cn=users,dc=swp-ldap,dc=internal"
+    bind_dn: "uid=ldapsearch_element,cn=users,{{ .Values.ldap.baseDn }}"
     bind_password: {{ .Values.secrets.nubus.ldapSearch.element | quote }}
-    filter: "(memberOf=cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,dc=swp-ldap,dc=internal)"
+    filter: "(memberOf=cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,{{ .Values.ldap.baseDn }})"
     uri: {{ printf "ldap://%s:389" .Values.ldap.host | quote }}
 cron:
   image:

helmfile/apps/element/values-synapse-adminbot-pipe.yaml.gotmpl

@@ -12,7 +12,6 @@ global:
 
 configuration:
   secretName: "matrix-adminbot-config"
-  #serviceName: "opendesk-synapse-adminbot-pipe"
 image:
   registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementPipe.registry | quote }}
   url: {{ .Values.images.elementPipe.repository | quote }}

helmfile/apps/element/values-synapse-adminbot-web.yaml.gotmpl

@@ -13,7 +13,6 @@ global:
 configuration:
   homeserver:
     serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
-#fullnameOverride: "opendesk-synapse-adminbot-web"
 image:
   registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementAdminBot.registry | quote }}
   repository: {{ .Values.images.elementAdminBot.repository | quote }}

helmfile/apps/element/values-synapse-auditbot-pipe.yaml.gotmpl

@@ -12,7 +12,6 @@ global:
 
 configuration:
   secretName: "matrix-auditbot-config"
-  #serviceName: "opendesk-synapse-auditbot-pipe"
 image:
   registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementPipe.registry | quote }}
   url: {{ .Values.images.elementPipe.repository | quote }}

helmfile/apps/element/values-synapse-groupsync.yaml.gotmpl

@@ -24,21 +24,21 @@ configuration:
       name: "description"
       uid: "uid"
     base: {{ .Values.ldap.baseDn | quote }}
-    bind_dn: "uid=ldapsearch_element,cn=users,dc=swp-ldap,dc=internal"
+    bind_dn: "uid=ldapsearch_element,cn=users,{{ .Values.ldap.baseDn }}"
     bind_password: {{ .Values.secrets.nubus.ldapSearch.element | quote }}
     check_interval_seconds: 60
     type: mapped-ldap
     uri: "ldap://ums-ldap-server:389"
   spaces:
     - groups:
-        - externalId: "cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,dc=swp-ldap,dc=internal"
+        - externalId: "cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,{{ .Values.ldap.baseDn }}"
           powerLevel: 50
-        - externalId: "cn=managed-by-attribute-Livecollaboration,cn=groups,dc=swp-ldap,dc=internal"
+        - externalId: "cn=managed-by-attribute-Livecollaboration,cn=groups,{{ .Values.ldap.baseDn }}"
       id: "c3122e32-4e05-4bf8-8a5d-66679076ed36"
       name: "openDesk"
       subspaces:
         - groups:
-            - externalId: "cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,dc=swp-ldap,dc=internal"
+            - externalId: "cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,{{ .Values.ldap.baseDn }}"
               powerLevel: 50
           id: "e7889d96-5baa-4e21-be6e-12c66b2e9565"
           name: "openDesk Element Admins"

helmfile/apps/element/values-synapse-web.yaml.gotmpl

@@ -4,6 +4,9 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+commonAnnotations:
+  {{ .Values.annotations.elementSynapseWeb.common | toYaml | nindent 2 }}
+
 clusterDomain: {{ .Values.cluster.networking.domain }}
 
 containerSecurityContext:
@@ -44,6 +47,9 @@ ingress:
     nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.element }}"
     nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.element }}s"
     nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.element }}s"
+    {{- with .Values.annotations.elementSynapseWeb.ingress }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   host: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
   enabled: {{ .Values.ingress.enabled }}
   ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
@@ -51,7 +57,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.elementSynapseWeb.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -62,4 +69,12 @@ replicaCount: {{ .Values.replicas.synapseWeb }}
 resources:
   {{ .Values.resources.synapseWeb | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.elementSynapseWeb.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementSynapseWeb.serviceAccount | toYaml | nindent 4 }}
+
 ...

helmfile/apps/element/values-synapse.yaml.gotmpl

@@ -4,6 +4,9 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+commonAnnotations:
+  {{ .Values.annotations.elementSynapse.common | toYaml | nindent 2 }}
+
 configuration:
   additionalConfiguration:
     user_directory:
@@ -69,8 +72,8 @@ configuration:
               regex: "@.*"
         url: null
         sender_localpart: ox-appsuite
-    {{- if (env "OPENDESK_ENTERPRISE") }}
-      {{- if .Values.elementAdmin.enabled }}
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      {{- if .Values.apps.elementAdmin.enabled }}
       - as_token: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
         hs_token: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
         id: "element-adminbot-pipe"
@@ -106,7 +109,7 @@ configuration:
         rate_limited: false
         sender_localpart: "auditbot-sendernotinuse"
       {{- end }}
-      {{- if .Values.elementGroupsync.enabled }}
+      {{- if .Values.apps.elementGroupsync.enabled }}
       - as_token: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
         hs_token: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
         id: "gps"
@@ -132,12 +135,12 @@ configuration:
 
     smtp:
       senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
-      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
       port: 25
       tls: false
       starttls: false
-      username: ""
-      password: ""
+      username: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
+      password: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
 
     oidc:
       clientId: "opendesk-matrix"
@@ -208,6 +211,8 @@ extraVolumeMounts:
 
 federation:
   enabled: {{ .Values.functional.externalServices.matrix.federation.enabled }}
+  domainAllowList:
+    {{ .Values.functional.externalServices.matrix.federation.domainAllowList | toYaml | nindent 4 }}
   ingress:
     host: "{{ .Values.global.hosts.synapseFederation }}.{{ .Values.global.domain }}"
     enabled: {{ .Values.ingress.enabled }}
@@ -215,6 +220,8 @@ federation:
     tls:
       enabled: {{ .Values.ingress.tls.enabled }}
       secretName: {{ .Values.ingress.tls.secretName | quote }}
+    annotations:
+      {{ .Values.annotations.elementSynapse.federationIngress | toYaml | nindent 6 }}
 
 global:
   domain: {{ .Values.global.domain | quote }}
@@ -232,8 +239,11 @@ image:
 persistence:
   size: {{ .Values.persistence.storages.synapse.size | quote }}
   storageClass: {{ coalesce .Values.persistence.storages.synapse.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  annotations:
+    {{ .Values.annotations.elementSynapse.persistence | toYaml | nindent 4 }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.elementSynapse.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -248,6 +258,14 @@ replicaCount: {{ .Values.replicas.synapse }}
 resources:
   {{ .Values.resources.synapse | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.elementSynapse.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementSynapse.serviceAccount | toYaml | nindent 4 }}
+
 tls:
   secretName: {{ if .Values.global.matrixDomain }}"opendesk-certificates-synapse-tls"{{ else }}"opendesk-certificates-tls"{{ end }}
 ...

helmfile/apps/element/values-well-known.yaml.gotmpl

@@ -4,6 +4,9 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+commonAnnotations:
+  {{ .Values.annotations.elementWellKnown.common | toYaml | nindent 2 }}
+
 configuration:
   e2ee:
     forceDisable: false
@@ -44,8 +47,11 @@ ingress:
   tls:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.elementWellKnown.ingress | toYaml | nindent 4 }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.elementWellKnown.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -56,4 +62,11 @@ replicaCount: {{ .Values.replicas.wellKnown }}
 resources:
   {{ .Values.resources.wellKnown | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.elementWellKnown.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementWellKnown.serviceAccount | toYaml | nindent 4 }}
 ...

helmfile/apps/jitsi/helmfile-child.yaml.gotmpl

@@ -10,7 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
 
 releases:
   - name: "jitsi"
@@ -21,7 +21,7 @@ releases:
       {{- range .Values.customization.release.jitsi }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.jitsi.enabled }}
+    installed: {{ .Values.apps.jitsi.enabled }}
     timeout: 900
 
 commonLabels:

helmfile/apps/jitsi/values-jitsi.yaml.gotmpl

@@ -10,8 +10,10 @@ global:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-  podAnnotations: {}
-
+  {{- if .Values.annotations.jitsiGlobal.pod }}
+  podAnnotations:
+    {{ .Values.annotations.jitsiGlobal.pod | toYaml | nindent 4}}
+  {{- end }}
 containerSecurityContext:
   allowPrivilegeEscalation: false
   enabled: true
@@ -49,6 +51,7 @@ extraVolumeMounts:
 
 cleanup:
   deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -76,6 +79,12 @@ jitsi:
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     ingress:
       enabled: {{ .Values.ingress.enabled }}
+      {{- if .Values.annotations.jitsiWeb.ingress }}
+      annotations:
+        {{- with .Values.annotations.jitsiWeb.ingress }}
+        {{ . | toYaml | nindent 8 }}
+        {{- end }}
+      {{- end }}
       ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
       hosts:
         - host: "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
@@ -103,6 +112,10 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.jitsi | toYaml | nindent 8 }}
+    {{- if .Values.annotations.jitsiWeb.pod }}
+    podAnnotations:
+      {{ .Values.annotations.jitsiWeb.pod | toYaml | nindent 6 }}
+    {{- end }}
   prosody:
     image:
       repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
@@ -152,6 +165,10 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.prosody | toYaml | nindent 8 }}
+    {{- if .Values.annotations.jitsiProsody.pod }}
+    podAnnotations:
+      {{ .Values.annotations.jitsiProsody.pod | toYaml | nindent 6 }}
+    {{- end }}
   jicofo:
     replicaCount: {{ .Values.replicas.jicofo }}
     image:
@@ -175,6 +192,10 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.jicofo | toYaml | nindent 8 }}
+    {{- if .Values.annotations.jitsiJicofo.pod }}
+    podAnnotations:
+      {{ .Values.annotations.jitsiJicofo.pod | toYaml | nindent 6 }}
+    {{- end }}
   jigasi:
     replicaCount: {{ .Values.replicas.jigasi }}
     enabled: {{ .Values.sip.jigasi.enabled }}
@@ -204,6 +225,10 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.jigasi | toYaml | nindent 8 }}
+    {{- if .Values.annotations.jitsiJigasi.pod }}
+    podAnnotations:
+      {{ .Values.annotations.jitsiJigasi.pod | toYaml | nindent 6 }}
+    {{- end }}
   jvb:
     replicaCount: {{ .Values.replicas.jvb }}
     # The `useNodeIP` option provided by the upstream charts does not support all relevant scenarios, but since
@@ -219,7 +244,11 @@ jitsi:
     resources:
       {{ .Values.resources.jvb | toYaml | nindent 6 }}
     service:
-      type: {{ .Values.cluster.service.type | quote }}
+      type: {{ coalesce .Values.service.type.jitsiVideoBridge .Values.cluster.service.type | quote }}
+    {{- if .Values.annotations.jitsiJvb.service }}
+      annotations:
+        {{ .Values.annotations.jitsiJvb.service | toYaml | nindent 8 }}
+    {{- end }}
     securityContext:
       allowPrivilegeEscalation: false
       capabilities: {}
@@ -232,6 +261,18 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.jvb | toYaml | nindent 8 }}
+    {{- if .Values.annotations.jitsiJvb.pod }}
+    podAnnotations:
+      {{ .Values.annotations.jitsiJvb.pod | toYaml | nindent 6 }}
+    {{- end }}
+    metrics:
+      prometheusAnnotations:
+        {{ .Values.annotations.jitsiJvb.metricsPrometheus | toYaml | nindent 8 }}
+      {{- if .Values.annotations.jitsiJvb.metricsGrafana }}
+      grafanaDashboards:
+        annotations:
+          {{ .Values.annotations.jitsiJvb.metricsGrafana | toYaml | nindent 10 }}
+      {{- end }}
   jibri:
     replicaCount: {{ .Values.replicas.jibri }}
     image:
@@ -248,10 +289,19 @@ jitsi:
       # Chart does not allow to template more
       capabilities:
         add: ["SYS_ADMIN"]
+    {{- if .Values.annotations.jitsiJibri.pod }}
+    podAnnotations:
+      {{ .Values.annotations.jitsiJibri.pod | toYaml | nindent 6 }}
+    {{- end }}
   imagePullSecrets:
   {{- range .Values.global.imagePullSecrets }}
     - name: {{ . | quote }}
   {{- end }}
+  {{- if .Values.annotations.jitsi.serviceAccount }}
+  serviceAccount:
+    annotations:
+      {{ .Values.annotations.jitsi.serviceAccount | toYaml | nindent 6 }}
+  {{- end }}
 
 patchJVB:
   configuration:
@@ -278,10 +328,17 @@ patchJVB:
     repository: {{ .Values.images.jitsiPatchJVB.repository | quote }}
     tag: {{ .Values.images.jitsiPatchJVB.tag | quote }}
 
-podAnnotations: {}
+{{- if .Values.annotations.jitsi.pod }}
+podAnnotations:
+  {{ .Values.annotations.jitsi.pod | toYaml | nindent 2 }}
+{{- end }}
 
 replicaCount: {{ .Values.replicas.jitsiKeycloakAdapter }}
 
 resources:
   {{ .Values.resources.jitsiKeycloakAdapter | toYaml | nindent 2 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.jitsi.serviceAccount | toYaml | nindent 4 }}
 ...

helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl

@@ -10,14 +10,14 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
   - name: "nextcloud-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.nextcloud.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
 
 releases:
   - name: "opendesk-nextcloud-management"
@@ -25,7 +25,7 @@ releases:
     version: "{{ .Values.charts.nextcloudManagement.version }}"
     values:
       - "values-nextcloud-mgmt.yaml.gotmpl"
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
       - "values-nextcloud-mgmt-enterprise.yaml.gotmpl"
       {{- end }}
       {{- range .Values.customization.release.opendeskNextcloudManagement }}
@@ -33,14 +33,14 @@ releases:
       {{- end }}
     waitForJobs: true
     wait: true
-    installed: {{ .Values.nextcloud.enabled }}
+    installed: {{ .Values.apps.nextcloud.enabled }}
     timeout: 900
   - name: "opendesk-nextcloud"
     chart: "nextcloud-repo/{{ .Values.charts.nextcloud.name }}"
     version: "{{ .Values.charts.nextcloud.version }}"
     values:
       - "values-nextcloud.yaml.gotmpl"
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
       - "values-nextcloud-enterprise.yaml.gotmpl"
       {{- end }}
       {{- range .Values.customization.release.opendeskNextcloud }}
@@ -48,7 +48,7 @@ releases:
       {{- end }}
     needs:
       - "opendesk-nextcloud-management"
-    installed: {{ .Values.nextcloud.enabled }}
+    installed: {{ .Values.apps.nextcloud.enabled }}
 
 commonLabels:
   deployStage: "050-components"

helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl

@@ -12,10 +12,15 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 additionalAnnotations:
-  intents.otterize.com/service-name: "opendesk-nextcloud-management"
+  intents.otterize.com/service-name: "opendesk-nextcloud-php"
+  {{- with .Values.annotations.nextcloudNextcloudMgmt.additional }}
+  {{ . | toYaml | nindent 2}}
+  {{- end }}
 
 cleanup:
   deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
+  keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
 
 configuration:
   administrator:
@@ -31,9 +36,9 @@ configuration:
     host: {{ .Values.antivirus.icap.host | quote }}
     port: {{ .Values.antivirus.icap.port | quote }}
     {{- else }}
-    {{- if .Values.clamavDistributed.enabled }}
+    {{- if .Values.apps.clamavDistributed.enabled }}
     host: "clamav-icap"
-    {{- else if .Values.clamavSimple.enabled }}
+    {{- else if .Values.apps.clamavSimple.enabled }}
     host: "clamav-simple"
     {{- end }}
     port: 1344
@@ -55,13 +60,13 @@ configuration:
       contacts:
         enabled: false
       cryptpad:
-        enabled: {{ .Values.cryptpad.enabled }}
+        enabled: {{ .Values.apps.cryptpad.enabled }}
       filesZip:
         enabled: true
       groupfolders:
         enabled: true
       integrationOpenproject:
-        enabled: {{ .Values.openproject.enabled }}
+        enabled: {{ .Values.apps.openproject.enabled }}
       spreed:
         enabled: true
     circles:
@@ -70,6 +75,7 @@ configuration:
   collabora:
     # internalWopiUrl: ""
     wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
+    defaultFormat: {{ .Values.functional.weboffice.defaultFormat | quote }}
 
   database:
     {{ if eq .Values.databases.nextcloud.type "mariadb" }}
@@ -121,10 +127,13 @@ configuration:
       value: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
 
   opendeskIntegration:
-    username:
-      value: "opendesk_username"
-    password:
-      value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+    centralNavigation:
+      username:
+        value: "opendesk_username"
+      password:
+        value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+    oxAppSuite:
+      enabled: {{ .Values.apps.oxAppSuite.enabled }}
 
   sharing:
     allowLinks: {{ .Values.functional.filestore.sharing.external.enabled }}
@@ -142,16 +151,16 @@ configuration:
 
   smtp:
     auth:
-      enabled: false
+      enabled: true
       username:
-        value: ""
+        value: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
       password:
-        value: ""
-    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
-    port: 25
+        value: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    port: 587
     fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
     mailDomain: "{{ .Values.global.domain }}"
-    security: ""
+    security: "tls"
     skipVerifyPeer: true
 
   quota:
@@ -161,7 +170,8 @@ configuration:
       versions: {{ .Values.functional.filestore.nextcloud.retentionObligation.versions | quote }}
 
   serverinfo:
-    token: {{ .Values.secrets.nextcloud.metricsToken | quote }}
+    token:
+      value: {{ .Values.secrets.nextcloud.metricsToken | quote }}
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -178,8 +188,6 @@ containerSecurityContext:
   runAsNonRoot: true
   seLinuxOptions:
     {{ .Values.seLinuxOptions.nextcloudManagement | toYaml | nindent 4 }}
-podSecurityContext:
-  fsGroup: 101
 
 debug:
   loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
@@ -208,10 +216,20 @@ image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.nextcloud.tag | quote }}
 
-theme:
-  {{ .Values.theme | toYaml | nindent 2 }}
+podAnnotations:
+  {{ .Values.annotations.nextcloudNextcloudMgmt.pod | toYaml | nindent 2 }}
+
+podSecurityContext:
+  fsGroup: 101
 
 resources:
   {{ .Values.resources.nextcloud | toYaml | nindent 4 }}
 
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.nextcloudNextcloudMgmt.serviceAccount | toYaml | nindent 4 }}
+
+theme:
+  {{ .Values.theme | toYaml | nindent 2 }}
+
 ...

helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl

@@ -9,6 +9,13 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 exporter:
+
+  additionalAnnotations:
+    intents.otterize.com/service-name: "opendesk-nextcloud-exporter"
+    {{- with .Values.annotations.nextcloudExporter.additional }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
+
   enabled: true
   configuration:
     server: "http://opendesk-nextcloud-aio"
@@ -34,7 +41,8 @@ exporter:
     repository: "{{ .Values.images.nextcloudExporter.repository }}"
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.nextcloudExporter.tag | quote }}
-  podAnnotations: {}
+  podAnnotations:
+    {{ .Values.annotations.nextcloudExporter.pod | toYaml | nindent 4 }}
   prometheus:
     serviceMonitor:
       enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
@@ -48,9 +56,17 @@ exporter:
   resources:
     {{ .Values.resources.nextcloudExporter | toYaml | nindent 4 }}
 
+  serviceAccount:
+    annotations:
+      {{ .Values.annotations.nextcloudExporter.serviceAccount | toYaml | nindent 6 }}
+
 aio:
   additionalAnnotations:
     intents.otterize.com/service-name: "opendesk-nextcloud-aio"
+    {{- with .Values.annotations.nextcloudAio.additional }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
+
   configuration:
     cache:
       auth:
@@ -102,6 +118,9 @@ aio:
       {{ .Values.seLinuxOptions.nextcloud | toYaml | nindent 6 }}
   cron:
     successfulJobsHistoryLimit: {{ if .Values.debug.enabled }}"3"{{ else }}"0"{{ end }}
+    resources:
+      {{ .Values.resources.nextcloudCron | toYaml | nindent 6 }}
+
   debug:
     loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
   {{- if .Values.certificate.selfSigned }}
@@ -136,11 +155,15 @@ aio:
       nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.nextcloud }}"
       nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.nextcloud }}s"
       nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.nextcloud }}s"
+      {{- with .Values.annotations.nextcloudAio.ingress }}
+        {{ . | toYaml | nindent 6 }}
+      {{- end }}
     ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
     host: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
     tls:
       secretName: {{ .Values.ingress.tls.secretName | quote }}
-  podAnnotations: {}
+  podAnnotations:
+    {{ .Values.annotations.nextcloudAio.pod | toYaml | nindent 4 }}
   podSecurityContext:
     fsGroup: 101
   prometheus:
@@ -156,4 +179,12 @@ aio:
   resources:
     {{ .Values.resources.nextcloud | toYaml | nindent 4 }}
 
+  service:
+    annotations:
+      {{ .Values.annotations.nextcloudAio.service | toYaml | nindent 6 }}
+
+  serviceAccount:
+    annotations:
+      {{ .Values.annotations.nextcloudAio.serviceAccount | toYaml | nindent 6 }}
+
 ...

helmfile/apps/notes/helmfile-child.yaml.gotmpl

@@ -10,7 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.notes.registry }}/{{ .Values.charts.notes.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.notes.registry }}/{{ .Values.charts.notes.repository }}"
 
 releases:
   - name: "impress"
@@ -22,7 +22,7 @@ releases:
       {{- range .Values.customization.release.notes }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.notes.enabled }}
+    installed: {{ .Values.apps.notes.enabled }}
     timeout: 1800
 
 commonLabels:

helmfile/apps/notes/values.yaml.gotmpl

@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  repository: {{ printf "%s/%s" (coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.notesBackend.registry) (.Values.images.notesBackend.repository) | quote }}
+  repository: {{ printf "%s/%s" (coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.notesBackend.registry) (.Values.images.notesBackend.repository) | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.notesBackend.tag }}
   credentials:
@@ -33,6 +33,9 @@ ingressCollaborationWS:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "86400"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "86400"
     nginx.ingress.kubernetes.io/upstream-hash-by: $arg_room
+    {{- with .Values.annotations.notes.ingressCollaborationWS }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
 
 ingressAdmin:
   enabled: {{ .Values.ingress.enabled }}
@@ -41,6 +44,8 @@ ingressAdmin:
   tls:
     enabled: "{{ .Values.ingress.tls.enabled }}"
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.notes.ingressAdmin | toYaml | nindent 4 }}
 
 ingressMedia:
   enabled: {{ .Values.ingress.enabled }}
@@ -48,12 +53,15 @@ ingressMedia:
   host: "{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}"
   annotations:
     nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/auth-url: "https://{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}/api/v1.0/documents/retrieve-auth/"
+    nginx.ingress.kubernetes.io/auth-url: "https://{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}/api/v1.0/documents/media-auth/"
     nginx.ingress.kubernetes.io/upstream-vhost: {{ .Values.objectstores.notes.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
     nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
     nginx.ingress.kubernetes.io/use-regex: "true"
     nginx.ingress.kubernetes.io/rewrite-target: /{{ .Values.objectstores.notes.bucket }}/$1
     nginx.ingress.kubernetes.io/session-cookie-path: /media
+    {{- with .Values.annotations.notes.ingressMedia }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   tls:
     enabled: "{{ .Values.ingress.tls.enabled }}"
     secretName: {{ .Values.ingress.tls.secretName | quote }}
@@ -66,11 +74,14 @@ ingressCollaborationApi:
   tls:
     enabled: "{{ .Values.ingress.tls.enabled }}"
     secretName: {{ .Values.ingress.tls.secretName | quote }}
-
+  annotations:
+    {{ .Values.annotations.notes.ingressCollaborationAPI | toYaml | nindent 4 }}
 
 serviceMedia:
   host: {{ .Values.objectstores.notes.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
   port: {{ .Values.objectstores.notes.port | default 443 }}
+  annotations:
+    {{ .Values.annotations.notes.serviceMedia | toYaml | nindent 4 }}
 
 frontend:
   image:
@@ -103,6 +114,13 @@ frontend:
     seLinuxOptions:
       {{ .Values.seLinuxOptions.notesFrontend | toYaml | nindent 6 }}
 
+  podAnnotations:
+    {{ .Values.annotations.notesFrontend.pod | toYaml | nindent 4 }}
+
+  service:
+    annotations:
+      {{ .Values.annotations.notesFrontend.service | toYaml | nindent 6 }}
+
 yProvider:
   image:
     repository: {{ printf "%s/%s" (coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.notesYProvider.registry) (.Values.images.notesYProvider.repository) | quote }}
@@ -131,6 +149,13 @@ yProvider:
     COLLABORATION_SERVER_SECRET: {{ .Values.secrets.notes.collaborationSecret | quote }}
     Y_PROVIDER_API_KEY: {{ .Values.secrets.notes.collaborationSecret | quote }}
 
+  podAnnotations:
+    {{ .Values.annotations.notesYProvider.pod | toYaml | nindent 4 }}
+
+  service:
+    annotations:
+      {{ .Values.annotations.notesYProvider.service | toYaml | nindent 6 }}
+
 oidc:
   clientId: "opendesk-notes"
   clientSecret: {{ .Values.secrets.keycloak.clientSecret.notes | quote }}
@@ -143,6 +168,10 @@ djangoSuperUserPass: {{ .Values.secrets.notes.superuser }}
 djangoSecretKey: {{ .Values.secrets.notes.djangoSecretKey }}
 
 backend:
+  image:
+    repository: {{ printf "%s/%s" (coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.notesBackend.registry) (.Values.images.notesBackend.repository) | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    tag: {{ .Values.images.notesBackend.tag }}
   replicas: {{ .Values.replicas.notesBackend }}
   envVars:
     DB_HOST: {{ .Values.databases.notes.host | quote }}
@@ -160,14 +189,22 @@ backend:
     AWS_S3_SECRET_ACCESS_KEY: {{ .Values.objectstores.notes.secretKey | default .Values.secrets.minio.notesUser | quote }}
     AWS_STORAGE_BUCKET_NAME: {{ .Values.objectstores.notes.bucket }}
     DJANGO_CSRF_TRUSTED_ORIGINS: {{ printf "https://%s.%s" .Values.global.hosts.notes .Values.global.domain | quote }}
+    DJANGO_SITE_DOMAIN: {{ printf "%s.%s" .Values.global.hosts.notes .Values.global.domain | quote }}
+    DJANGO_SITE_NAME: {{ printf "%s.%s" .Values.global.hosts.notes .Values.global.domain | quote }}
     DJANGO_CONFIGURATION: Production
     DJANGO_ALLOWED_HOSTS: "*"
     DJANGO_SECRET_KEY: {{ .Values.secrets.notes.djangoSecretKey }}
     DJANGO_SETTINGS_MODULE: impress.settings
     DJANGO_SUPERUSER_PASSWORD: {{ .Values.secrets.notes.superuser }}
+    DJANGO_EMAIL_BRAND_NAME: "openDesk"
+    DJANGO_EMAIL_LOGO_IMG: {{ printf "https://%s.%s/univention/portal/icons/entries/swp.notes.svg" .Values.global.hosts.nubus .Values.global.domain | quote }}
+    DJANGO_EMAIL_FROM: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
     DJANGO_EMAIL_HOST: "postfix"
     DJANGO_EMAIL_PORT: 25
     DJANGO_EMAIL_USE_SSL: False
+    DJANGO_EMAIL_HOST_USER: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
+    DJANGO_EMAIL_HOST_PASSWORD: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+    DJANGO_EMAIL_USE_TLS: False
     OIDC_RP_CLIENT_ID: "opendesk-notes"
     OIDC_RP_CLIENT_SECRET: {{ .Values.secrets.keycloak.clientSecret.notes | quote }}
     OIDC_OP_JWKS_ENDPOINT: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
@@ -178,7 +215,8 @@ backend:
     OIDC_RP_SIGN_ALGO: RS256
     OIDC_RP_SCOPES: "openid opendesk-notes-scope"
     USER_OIDC_FIELD_TO_SHORTNAME: "given_name"
-    USER_OIDC_FIELDS_TO_FULLNAME: "given_name family_name"
+    USER_OIDC_FIELDS_TO_FULLNAME: "given_name,family_name"
+    USER_OIDC_ESSENTIAL_CLAIMS: "email"
     OIDC_REDIRECT_ALLOWED_HOSTS: {{ printf "https://%s.%s/*" .Values.global.hosts.notes .Values.global.domain | quote }}
     OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{}"
     OIDC_RENEW_ID_TOKEN: "False"
@@ -199,10 +237,12 @@ backend:
       - "/bin/sh"
       - "-c"
       - |
-        python manage.py migrate --no-input &&
-        python manage.py create_demo --force
+        python manage.py migrate --no-input
     restartPolicy: Never
 
+  migrateJobAnnotations:
+    {{ .Values.annotations.notesBackend.migrateJob | toYaml | nindent 4 }}
+
   createsuperuser:
     command:
       - "/bin/sh"
@@ -211,6 +251,9 @@ backend:
         python manage.py createsuperuser --email default.admin@{{ .Values.global.domain }} --password {{ .Values.secrets.notes.superuser }}
     restartPolicy: Never
 
+  podAnnotations:
+    {{ .Values.annotations.notesBackend.pod | toYaml | nindent 4 }}
+
   resources:
     {{ .Values.resources.notesBackend | toYaml | nindent 4 }}
   securityContext:
@@ -227,4 +270,9 @@ backend:
     runAsNonRoot: true
     seLinuxOptions:
       {{ .Values.seLinuxOptions.notesBackend | toYaml | nindent 6 }}
+
+  service:
+    annotations:
+      {{ .Values.annotations.notesBackend.service | toYaml | nindent 6 }}
+
 ...

helmfile/apps/nubus/helmfile-child.yaml.gotmpl

@@ -10,7 +10,7 @@ repositories:
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
     url:
-      "{{ .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
+      "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
   # Intercom Service
   # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
   - name: "intercom-service-repo"
@@ -19,7 +19,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
   # openDesk Keycloak Bootstrap Chart
   - name: "opendesk-keycloak-bootstrap-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
@@ -27,7 +27,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
   # NGINX S3 Gateway Chart
   - name: "nginx-s3-gateway-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
@@ -35,7 +35,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"
 
 releases:
   # Univention Management Stack Umbrella Chart
@@ -47,7 +47,7 @@ releases:
       {{- range .Values.customization.release.ums }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.nubus.enabled }}
+    installed: {{ .Values.apps.nubus.enabled }}
     timeout: 900
   # Intercom-Service
   - name: "intercom-service"
@@ -58,7 +58,7 @@ releases:
       {{- range .Values.customization.release.intercomService }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.nubus.enabled }}
+    installed: {{ .Values.apps.nubus.enabled }}
 
   # openDesk Keycloak Bootstrap Chart
   - name: "opendesk-keycloak-bootstrap"
@@ -71,10 +71,10 @@ releases:
       {{- end }}
     needs:
       - "ums"
-    installed: {{ .Values.nubus.enabled }}
+    installed: {{ .Values.apps.nubus.enabled }}
     timeout: 900
 
-  # NGINX S3 Gateway (when cluster minio is not used)
+  # NGINX S3 Gateway
   - name: "nubus"
     chart: "nginx-s3-gateway-repo/{{ .Values.charts.nginxS3Gateway.name }}"
     version: "{{ .Values.charts.nginxS3Gateway.version }}"
@@ -83,7 +83,7 @@ releases:
       {{- range .Values.customization.release.nginxS3Gateway }}
       - {{ . }}
       {{- end }}
-    installed: {{ not .Values.minio.enabled }}
+    installed: {{ .Values.apps.nubus.enabled }}
     timeout: 900
 
 commonLabels:

helmfile/apps/nubus/values-intercom-service.yaml.gotmpl

@@ -4,6 +4,9 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+additionalAnnotations:
+  {{ .Values.annotations.nubusIntercomService.additional | toYaml | nindent 2 }}
+
 containerSecurityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -53,6 +56,7 @@ ics:
   secret: {{ .Values.secrets.intercom.secret | quote }}
   issuerBaseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
   originRegex: "{{ .Values.global.domain }}"
+  enableSessionCookie: true
   userUniqueMapper: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"opendesk_useruuid"{{ else }}"opendesk_username"{{ end }}
   usernameClaim: "opendesk_username"
   keycloak:
@@ -98,8 +102,11 @@ ingress:
   tls:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.nubusIntercomService.ingress | toYaml | nindent 4 }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.nubusIntercomService.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -149,4 +156,11 @@ replicaCount: {{ .Values.replicas.intercomService }}
 resources:
   {{ .Values.resources.intercomService | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.nubusIntercomService.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.nubusIntercomService.serviceAccount | toYaml | nindent 4 }}
 ...

helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl

@@ -3,6 +3,13 @@ SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlic
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+global:
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+additionalAnnotations:
+  {{ .Values.annotations.nubusNginxS3Gateway.additional | toYaml | nindent 2 }}
+
 image:
   registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nginxS3Gateway.registry | quote }}
   repository: {{ .Values.images.nginxS3Gateway.repository | quote }}
@@ -16,6 +23,10 @@ ingress:
   annotations:
     nginx.ingress.kubernetes.io/rewrite-target: "/portal-assets/icons/$2/$3"
     nginx.ingress.kubernetes.io/use-regex: "true"
+    {{- with .Values.annotations.nubusNginxS3Gateway.ingress }}
+    {{. | toYaml | nindent 4 }}
+    {{- end }}
+
   path: "/univention/(portal|selfservice)/icons/(logos|entries)/(.*)$"
   tls:
     secretName: {{ .Values.ingress.tls.secretName | quote }}
@@ -32,8 +43,20 @@ configuration:
     secretKey:
       value: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
 
+podAnnotations:
+  {{ .Values.annotations.nubusNginxS3Gateway.pod | toYaml | nindent 2 }}
+
 resources:
   {{ .Values.resources.nginxS3Gateway | toYaml | nindent 2 }}
 
 replicaCount: {{ .Values.replicas.nginxS3Gateway }}
+
+service:
+  annotations:
+    {{ .Values.annotations.nubusNginxS3Gateway.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.nubusNginxS3Gateway.serviceAccount | toYaml | nindent 4 }}
+
 ...

helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl

@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
@@ -18,35 +18,47 @@ image:
 
 cleanup:
   deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
   keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
 
 config:
   clientAccessRestrictions:
+    {{- if .Values.apps.element.enabled }}
     matrix:
       client: "opendesk-matrix"
       scope: "opendesk-matrix-scope"
       role: "opendesk-matrix-access-control"
       group: "managed-by-attribute-Livecollaboration"
+    {{- end }}
+    {{- if .Values.apps.jitsi.enabled }}
     jitsi:
       client: "opendesk-jitsi"
       scope: "opendesk-jitsi-scope"
       role: "opendesk-jitsi-access-control"
       group: "managed-by-attribute-Videoconference"
+    {{- end }}
+    {{- if .Values.apps.xwiki.enabled }}
     xwiki:
       client: "opendesk-xwiki"
       scope: "opendesk-xwiki-scope"
       role: "opendesk-xwiki-access-control"
       group: "managed-by-attribute-Knowledgemanagement"
+    {{- end }}
+    {{- if .Values.apps.openproject.enabled }}
     openproject:
       client: "opendesk-openproject"
       scope: "opendesk-openproject-scope"
       role: "opendesk-openproject-access-control"
       group: "managed-by-attribute-Projectmanagement"
+    {{- end }}
+    {{- if .Values.apps.nextcloud.enabled }}
     nextcloud:
       client: "opendesk-nextcloud"
       scope: "opendesk-nextcloud-scope"
       role: "opendesk-nextcloud-access-control"
       group: "managed-by-attribute-Fileshare"
+    {{- end }}
+    {{- if .Values.apps.oxAppSuite.enabled }}
     oxAppSuite:
       client: "opendesk-oxappsuite"
       scope: "opendesk-oxappsuite-scope"
@@ -57,7 +69,8 @@ config:
       scope: "opendesk-dovecot-scope"
       role: "opendesk-dovecot-access-control"
       group: "managed-by-attribute-Groupware"
-    {{- if .Values.notes.enabled }}
+    {{- end }}
+    {{- if .Values.apps.notes.enabled }}
     notes:
       client: "opendesk-notes"
       scope: "opendesk-notes-scope"
@@ -65,8 +78,6 @@ config:
       group: "managed-by-attribute-Notes"
     {{- end }}
 
-  componentEnabled:
-    notes: {{ .Values.notes.enabled }}
   custom:
     clientScopes:
       {{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
@@ -79,22 +90,42 @@ config:
                '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}',
                '${client_security-admin-console}' ]
   keycloak:
-    adminUser: "kcadmin"
-    adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
+    admin:
+      values:
+        username: "kcadmin"
+        password: {{ .Values.secrets.keycloak.adminPassword | quote }}
     realm: {{ .Values.platform.realm | quote }}
     intraCluster:
       enabled: true
       internalBaseUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
+  realmSettings:
+    accessTokenLifespan: {{ .Values.functional.authentication.realmSettings.accessTokenLifespan }}
+    revokeRefreshToken: {{ .Values.functional.authentication.realmSettings.revokeRefreshToken }}
+    ssoSessionIdleTimeout: {{ .Values.functional.authentication.realmSettings.ssoSessionIdleTimeout }}
+    ssoSessionMaxLifespan: {{ .Values.functional.authentication.realmSettings.ssoSessionMaxLifespan }}
+    offlineSessionIdleTimeout: {{ .Values.functional.authentication.realmSettings.offlineSessionIdleTimeout }}
+    offlineSessionMaxLifespanEnabled: {{ .Values.functional.authentication.realmSettings.offlineSessionMaxLifespanEnabled }}
+    offlineSessionMaxLifespan: {{ .Values.functional.authentication.realmSettings.offlineSessionMaxLifespan }}
+    clientSessionIdleTimeout: {{ .Values.functional.authentication.realmSettings.clientSessionIdleTimeout }}
+    clientSessionMaxLifespan: {{ .Values.functional.authentication.realmSettings.clientSessionMaxLifespan }}
+    clientOfflineSessionIdleTimeout: {{ .Values.functional.authentication.realmSettings.clientOfflineSessionIdleTimeout }}
+    clientOfflineSessionMaxLifespan: {{ .Values.functional.authentication.realmSettings.clientOfflineSessionMaxLifespan }}
+  ssoFederation:
+    enabled: {{ .Values.functional.authentication.ssoFederation.enabled }}
+    enforceFederatedLogin: {{ .Values.functional.authentication.ssoFederation.enforceFederatedLogin }}
+    name: {{ .Values.functional.authentication.ssoFederation.name | quote }}
+    idpDetails: {{ .Values.functional.authentication.ssoFederation.idpDetails | toYaml | nindent 6 }}
   twoFactorSettings:
-    additionalGroups: {{ .Values.functional.authentication.twoFactor.groups }}
+    additionalGroups: {{ .Values.functional.authentication.twoFactor.groups | toYaml | nindent 6 }}
   precreateGroups: [ 'Domain Admins', 'Domain Users', '2fa-users', 'IAM API - Full Access',
-                     'managed-by-attribute-Fileshare', 'managed-by-attribute-FileshareAdmin',
-                     'managed-by-attribute-Knowledgemanagement', 'managed-by-attribute-KnowledgemanagementAdmin',
-                     'managed-by-attribute-Livecollaboration', 'managed-by-attribute-LivecollaborationAdmin',
-                     'managed-by-attribute-Projectmanagement', 'managed-by-attribute-ProjectmanagementAdmin',
-                     'managed-by-attribute-Videoconference',
-                     'managed-by-attribute-Groupware',
-                     'managed-by-attribute-Notes' ]
+                     {{ if .Values.apps.nextcloud.enabled }}'managed-by-attribute-Fileshare', 'managed-by-attribute-FileshareAdmin',{{ end }}
+                     {{ if .Values.apps.xwiki.enabled }}'managed-by-attribute-Knowledgemanagement', 'managed-by-attribute-KnowledgemanagementAdmin',{{ end }}
+                     {{ if .Values.apps.element.enabled }}'managed-by-attribute-Livecollaboration', 'managed-by-attribute-LivecollaborationAdmin',{{ end }}
+                     {{ if .Values.apps.openproject.enabled }}'managed-by-attribute-Projectmanagement', 'managed-by-attribute-ProjectmanagementAdmin',{{ end }}
+                     {{ if .Values.apps.jitsi.enabled }}'managed-by-attribute-Videoconference',{{ end }}
+                     {{ if .Values.apps.oxAppSuite.enabled }}'managed-by-attribute-Groupware',{{ end }}
+                     {{ if .Values.apps.notes.enabled }}'managed-by-attribute-Notes',{{ end }}
+                   ]
 
   opendesk:
     # We use client specific scopes as we bind them to Keycloak role membership which itself is linked
@@ -105,6 +136,7 @@ config:
         protocol: "openid-connect"
       - name: "write_contacts"
         protocol: "openid-connect"
+      {{ if .Values.apps.openproject.enabled }}
       - name: "opendesk-openproject-scope"
         description: "Scope for the claims required by openDesk's OpenProject instance."
         protocol: "openid-connect"
@@ -178,6 +210,8 @@ config:
               access.token.claim: true
               claim.name: "family_name"
               jsonType.label: "String"
+      {{ end }}
+      {{ if .Values.apps.jitsi.enabled }}
       - name: "opendesk-jitsi-scope"
         description: "Scope for the claims required by openDesk's Jitsi instance."
         protocol: "openid-connect"
@@ -225,6 +259,8 @@ config:
               access.token.claim: true
               claim.name: "email"
               jsonType.label: "String"
+      {{ end }}
+      {{ if .Values.apps.nextcloud.enabled }}
       - name: "opendesk-nextcloud-scope"
         description: "Scope for the claims required by openDesk's Nextcloud instance."
         protocol: "openid-connect"
@@ -274,6 +310,8 @@ config:
               access.token.claim: true
               claim.name: "context"
               jsonType.label: "String"
+      {{ end }}
+      {{ if .Values.apps.element.enabled }}
       - name: "opendesk-matrix-scope"
         description: "Scope for the claims required by openDesk's Matrix instance."
         protocol: "openid-connect"
@@ -321,6 +359,8 @@ config:
               access.token.claim: true
               claim.name: "email"
               jsonType.label: "String"
+      {{ end }}
+      {{ if .Values.apps.xwiki.enabled }}
       - name: "opendesk-xwiki-scope"
         description: "Scope for the claims required by openDesk's XWiki instance."
         protocol: "openid-connect"
@@ -368,6 +408,8 @@ config:
               access.token.claim: true
               claim.name: "email"
               jsonType.label: "String"
+      {{ end }}
+      {{ if .Values.apps.oxAppSuite.enabled }}
       - name: "opendesk-dovecot-scope"
         description: "Scope for the claims required by openDesk's Dovecot instance."
         protocol: "openid-connect"
@@ -431,7 +473,8 @@ config:
               access.token.claim: true
               claim.name: "opendesk_username"
               jsonType.label: "String"
-{{ if .Values.notes.enabled }}
+      {{ end }}
+      {{ if .Values.apps.notes.enabled }}
       - name: "opendesk-notes-scope"
         description: "Scope for the claims required by openDesk's Notes instance."
         protocol: "openid-connect"
@@ -472,7 +515,7 @@ config:
               access.token.claim: true
               claim.name: "family_name"
               jsonType.label: "String"
-{{ end }}
+      {{ end }}
     clients:
       - name: "opendesk-intercom"
         clientId: "opendesk-intercom"
@@ -522,7 +565,7 @@ config:
               jsonType.label: "String"
         defaultClientScopes:
           - "offline_access"
-{{ if .Values.notes.enabled }}
+      {{ if .Values.apps.notes.enabled }}
       - name: "opendesk-notes"
         clientId: "opendesk-notes"
         protocol: "openid-connect"
@@ -560,7 +603,8 @@ config:
           user.info.response.signature.alg: "RS256"
         defaultClientScopes:
           - "opendesk-notes-scope"
-{{ end }}
+      {{ end }}
+      {{ if .Values.apps.oxAppSuite.enabled }}
       - name: "opendesk-dovecot"
         clientId: "opendesk-dovecot"
         protocol: "openid-connect"
@@ -574,6 +618,28 @@ config:
           backchannel.logout.session.required: false
         defaultClientScopes:
           - "opendesk-dovecot-scope"
+      - name: "opendesk-oxappsuite"
+        clientId: "opendesk-oxappsuite"
+        protocol: "openid-connect"
+        clientAuthenticatorType: "client-secret"
+        secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
+        redirectUris:
+          - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+        consentRequired: false
+        frontchannelLogout: false
+        publicClient: false
+        authorizationServicesEnabled: false
+        attributes:
+          backchannel.logout.session.required: true
+          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+        defaultClientScopes:
+          - "opendesk-oxappsuite-scope"
+          - "read_contacts"
+          - "write_contacts"
+      {{ end }}
+      {{ if .Values.apps.jitsi.enabled }}
       - name: "opendesk-jitsi"
         clientId: "opendesk-jitsi"
         protocol: "openid-connect"
@@ -587,6 +653,8 @@ config:
         authorizationServicesEnabled: false
         defaultClientScopes:
           - "opendesk-jitsi-scope"
+      {{ end }}
+      {{ if .Values.apps.element.enabled }}
       - name: "opendesk-matrix"
         clientId: "opendesk-matrix"
         protocol: "openid-connect"
@@ -609,6 +677,8 @@ config:
           post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
         defaultClientScopes:
           - "opendesk-matrix-scope"
+      {{ end }}
+      {{ if .Values.apps.nextcloud.enabled }}
       - name: "opendesk-nextcloud"
         clientId: "opendesk-nextcloud"
         protocol: "openid-connect"
@@ -629,6 +699,8 @@ config:
           - "opendesk-nextcloud-scope"
           - "read_contacts"
           - "write_contacts"
+      {{ end }}
+      {{ if .Values.apps.openproject.enabled }}
       - name: "opendesk-openproject"
         clientId: "opendesk-openproject"
         protocol: "openid-connect"
@@ -648,26 +720,8 @@ config:
           post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
         defaultClientScopes:
           - "opendesk-openproject-scope"
-      - name: "opendesk-oxappsuite"
-        clientId: "opendesk-oxappsuite"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          backchannel.logout.session.required: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        defaultClientScopes:
-          - "opendesk-oxappsuite-scope"
-          - "read_contacts"
-          - "write_contacts"
+      {{ end }}
+      {{ if .Values.apps.xwiki.enabled }}
       - name: "opendesk-xwiki"
         clientId: "opendesk-xwiki"
         protocol: "openid-connect"
@@ -686,6 +740,7 @@ config:
           post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
         defaultClientScopes:
           - "opendesk-xwiki-scope"
+      {{ end }}
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -704,11 +759,17 @@ containerSecurityContext:
     {{ .Values.seLinuxOptions.opendeskKeycloakBootstrap | toYaml | nindent 4 }}
 
 additionalAnnotations:
-    argocd.argoproj.io/hook: "Sync"
-    argocd.argoproj.io/hook-delete-policy: "BeforeHookCreation"
+  argocd.argoproj.io/hook: "Sync"
+  argocd.argoproj.io/hook-delete-policy: "BeforeHookCreation"
+  {{- with .Values.annotations.nubusKeycloakBootstrap.additional }}
+  {{. | toYaml | nindent 2 }}
+  {{- end }}
 
 podAnnotations:
   intents.otterize.com/service-name: "ums-keycloak-bootstrap"
+  {{- with .Values.annotations.nubusKeycloakBootstrap.pod }}
+  {{. | toYaml | nindent 2 }}
+  {{- end }}
 
 podSecurityContext:
   enabled: true
@@ -718,6 +779,10 @@ podSecurityContext:
 resources:
   {{ .Values.resources.opendeskKeycloakBootstrap | toYaml | nindent 2 }}
 
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.nubusKeycloakBootstrap.serviceAccount | toYaml | nindent 4 }}
+
 {{- if .Values.certificate.selfSigned }}
 extraVolumes:
   - name: "trusted-cert-secret-volume"

helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
@@ -7,19 +7,31 @@ repositories:
   - name: "dovecot-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.dovecot.verify }}
+    oci: true
+  {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+  {{- else }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+  {{- end }}
 
   # Open-Xchange
   - name: "open-xchange-repo"
     keyring: "../../files/gpg-pubkeys/open-xchange-com.gpg"
     verify: {{ .Values.charts.oxAppSuite.verify }}
+    oci: true
+  {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
+  {{- else }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
+  {{- end }}
 
   # openDesk Open-Xchange Bootstrap
   # Source:
@@ -30,14 +42,24 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"
 
   # OX Connector
   - name: "ox-connector-repo"
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
+
+  # openDesk Postfix
+  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
+  - name: "postfix-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.postfix.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
 
 releases:
   - name: "dovecot"
@@ -45,10 +67,24 @@ releases:
     version: "{{ .Values.charts.dovecot.version }}"
     values:
       - "values-dovecot.yaml.gotmpl"
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "values-dovecot-enterprise.yaml.gotmpl"
+      {{- end }}
       {{- range .Values.customization.release.dovecot }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.dovecot.enabled }}
+    installed: {{ .Values.apps.dovecot.enabled }}
+    timeout: 900
+
+  - name: "postfix-ox"
+    chart: "postfix-repo/{{ .Values.charts.postfix.name }}"
+    version: "{{ .Values.charts.postfix.version }}"
+    values:
+      - "values-postfix.yaml.gotmpl"
+      {{- range .Values.customization.release.postfix }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.postfix.enabled }}
     timeout: 900
 
   - name: "open-xchange"
@@ -57,13 +93,13 @@ releases:
     values:
       - "values-openxchange.yaml.gotmpl"
       - "values-openxchange-contact-picker.yaml.gotmpl"
-      {{- if (env "OPENDESK_ENTERPRISE") }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
       - "values-openxchange-enterprise.yaml.gotmpl"
       {{- end }}
       {{- range .Values.customization.release.openxchange }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.oxAppSuite.enabled }}
+    installed: {{ .Values.apps.oxAppSuite.enabled }}
     timeout: 900
 
   - name: "opendesk-open-xchange-bootstrap"
@@ -74,7 +110,7 @@ releases:
       {{- range .Values.customization.release.opendeskOpenxchangeBootstrap }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.oxAppSuite.enabled }}
+    installed: {{ .Values.apps.oxAppSuite.enabled }}
     timeout: 900
 
   - name: "ox-connector"
@@ -85,7 +121,7 @@ releases:
       {{- range .Values.customization.release.oxConnector }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.oxAppSuite.enabled }}
+    installed: {{ .Values.apps.oxAppSuite.enabled }}
     needs:
       - "open-xchange"
 

helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl

@@ -0,0 +1,48 @@
+{{/*
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.dovecot.registry | quote }}
+  repository: {{ .Values.images.dovecot.repository | quote }}
+  tag: {{ .Values.images.dovecot.tag | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+imageInitCassandra:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.cassandra.registry | quote }}
+  repository: {{ .Values.images.cassandra.repository | quote }}
+  tag: {{ .Values.images.cassandra.tag | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+imagePullSecrets:
+  {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}
+
+dovecot:
+  dictmap:
+    enabled: true
+    host: {{ .Values.databases.dovecotDictmap.host | quote }}
+    port: {{ .Values.databases.dovecotDictmap.port }}
+    username: {{ .Values.databases.dovecotDictmap.username | quote }}
+    password:
+      value: {{ .Values.secrets.cassandra.dovecotDictmapUser | quote }}
+    keyspace: {{ .Values.databases.dovecotDictmap.name | quote }}
+  sharedMailboxes:
+    enabled: false
+    host: {{ .Values.databases.dovecotACL.host | quote }}
+    port: {{ .Values.databases.dovecotACL.port }}
+    username: {{ .Values.databases.dovecotACL.username | quote }}
+    password:
+      value: {{ .Values.secrets.cassandra.dovecotACLUser | quote }}
+    keyspace: {{ .Values.databases.dovecotACL.name | quote }}
+  objectStorage:
+    encryption:
+      privateKey:
+        value: {{ env "DOVECOT_CRYPT_PRIVATE_KEY" | quote }}
+      publicKey:
+        value: {{ env "DOVECOT_CRYPT_PUBLIC_KEY" | quote }}
+    fqdn: {{ .Values.objectstores.dovecot.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    username: {{ .Values.objectstores.dovecot.username | quote }}
+    password:
+      value: {{ .Values.secrets.minio.dovecotUser | quote }}
+...

helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl

@@ -1,44 +1,58 @@
 {{/*
-SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+commonAnnotations:
+  {{ .Values.annotations.openxchangeDovecot.common | toYaml | nindent 2 }}
+
 image:
   registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.dovecot.registry | quote }}
   repository: {{ .Values.images.dovecot.repository | quote }}
   tag: {{ .Values.images.dovecot.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
+imageInitDovecot:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.dovecotBootstrap.registry | quote }}
+  repository: {{ .Values.images.dovecotBootstrap.repository | quote }}
+  tag: {{ .Values.images.dovecotBootstrap.tag | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
 imagePullSecrets:
   {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}
 
 dovecot:
-  mailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
-  password: {{ .Values.secrets.dovecot.doveadm | quote }}
+  mailDomains: {{ toYaml (prepend .Values.global.additionalMailDomains (.Values.global.mailDomain | default .Values.global.domain) | uniq) | nindent 4 }}
+  defaultMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
+  password:
+    value: {{ .Values.secrets.dovecot.doveadm | quote }}
   migration:
     enabled: {{ .Values.functional.migration.oxAppSuite.enabled }}
-    masterPassword: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
+    masterPassword:
+      value: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
   ldap:
     enabled: true
     host: {{ .Values.ldap.host | quote }}
     port: 389
-    base: "dc=swp-ldap,dc=internal"
-    dn: "uid=ldapsearch_dovecot,cn=users,dc=swp-ldap,dc=internal"
-    password: {{ .Values.secrets.nubus.ldapSearch.dovecot | quote }}
+    base: "{{ .Values.ldap.baseDn }}"
+    dn: "uid=ldapsearch_dovecot,cn=users,{{ .Values.ldap.baseDn }}"
+    password:
+      value: {{ .Values.secrets.nubus.ldapSearch.dovecot | quote }}
   oidc:
     enabled: true
-    clientID: "opendesk-dovecot"
-    clientSecret: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
+    clientID:
+      value: "opendesk-dovecot"
+    clientSecret:
+      value: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
     introspectionHost: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
     introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
     usernameAttribute: "opendesk_username"
   loginTrustedNetworks: {{ join " " .Values.cluster.networking.cidr | quote }}
-
   submission:
     enabled: true
     ssl: "no"
-    host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"
+    host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"
 
 certificate:
   secretName: {{ .Values.ingress.tls.secretName | quote }}
@@ -69,9 +83,6 @@ containerSecurityContext:
   seLinuxOptions:
     {{ .Values.seLinuxOptions.dovecot | toYaml | nindent 4 }}
 
-
-podAnnotations: {}
-
 {{- if .Values.certificate.selfSigned }}
 extraVolumes:
   - name: "trusted-cert-secret-volume"
@@ -101,14 +112,26 @@ persistence:
     - "ReadWriteOnce"
   {{- end }}
   size: {{ .Values.persistence.storages.dovecot.size | quote }}
+  annotations:
+    {{ .Values.annotations.openxchangeDovecot.persistence | toYaml | nindent 4 }}
+
+podAnnotations:
+  {{ .Values.annotations.openxchangeDovecot.pod | toYaml | nindent 2 }}
 
 resources:
   {{ .Values.resources.dovecot | toYaml | nindent 2 }}
 
-{{- if or (eq .Values.cluster.service.type "NodePort") (eq .Values.cluster.service.type "LoadBalancer") }}
+{{- if or (eq (coalesce .Values.service.type.dovecot .Values.cluster.service.type) "NodePort") (eq (coalesce .Values.service.type.dovecot .Values.cluster.service.type) "LoadBalancer") }}
 service:
+  annotations:
+    {{ .Values.annotations.openxchangeDovecot.service | toYaml | nindent 4 }}
   external:
     enabled: true
-    type: {{ .Values.cluster.service.type | quote }}
+    type: {{ coalesce .Values.service.type.dovecot .Values.cluster.service.type | quote }}
 {{- end }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.openxchangeDovecot.serviceAccount | toYaml | nindent 4 }}
+
 ...

helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml.gotmpl

@@ -4,6 +4,13 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+additionalAnnotations:
+  argocd.argoproj.io/hook: "Sync"
+  argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
+  {{- with .Values.annotations.openxchangeBootstrap.additional }}
+  {{ . | toYaml | nindent 2 }}
+  {{- end }}
+
 cleanup:
   deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
   deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
@@ -31,7 +38,8 @@ image:
 imagePullSecrets:
   {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}
 
-additionalAnnotations:
-  argocd.argoproj.io/hook: "Sync"
-  argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.openxchangeBootstrap.serviceAccount | toYaml | nindent 4 }}
+
 ...

helmfile/apps/open-xchange/values-openxchange-contact-picker.yaml.gotmpl

@@ -6,7 +6,11 @@ SPDX-License-Identifier: Apache-2.0
 ---
 appsuite:
   core-mw:
-
+    podAnnotations:
+      logging.open-xchange.com/format: "appsuite-json"
+      {{- with .Values.annotations.openxchangeEnterpriseContactPicker.appsuiteCoreMwPod }}
+      {{ . | toYaml | nindent 6 }}
+      {{- end }}
     properties:
       # Enterprise contact picker
       com.openexchange.contacts.ldap.accounts: "opendesk,other,functional"
@@ -25,9 +29,13 @@ appsuite:
           auth:
             type: "adminDN"
             adminDN:
-              dn: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
+              dn: "uid=ldapsearch_ox,cn=users,{{ .Values.ldap.baseDn }}"
               password: {{ .Values.secrets.nubus.ldapSearch.ox | quote }}
 
+    serviceAccount:
+      annotations:
+        {{ .Values.annotations.openxchangeEnterpriseContactPicker.appsuiteCoreMwServiceAccount | toYaml | nindent 8 }}
+
     uiSettings:
       # Enterprise contact picker
       io.ox/core//features/enterprisePicker/enabled: "true"

helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl

@@ -13,10 +13,14 @@ global:
   mysql:
     host: {{ .Values.databases.oxAppSuite.host | quote }}
     database: {{ .Values.databases.oxAppSuite.name | quote }}
+    readHost: {{ .Values.databases.oxAppSuite.readHost | quote }}
+    readDatabase: {{ .Values.databases.oxAppSuite.name | quote }}
     auth:
       user: {{ .Values.databases.oxAppSuite.username | quote }}
       password: {{ .Values.databases.oxAppSuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
       rootPassword: {{ .Values.databases.oxAppSuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
+      readUser: {{ .Values.databases.oxAppSuite.readUser | default .Values.databases.oxAppSuite.username | quote }}
+      readPassword: {{ .Values.databases.oxAppSuite.readPassword | default .Values.databases.oxAppSuite.password | quote}}
 
 nextcloud-integration-ui:
   image:
@@ -28,7 +32,8 @@ nextcloud-integration-ui:
   {{- range .Values.global.imagePullSecrets }}
     - name: {{ . | quote }}
   {{- end }}
-  podAnnotations: {}
+  podAnnotations:
+    {{ .Values.annotations.openxchangeNextcloudIntegrationUi.pod | toYaml | nindent 4 }}
   replicaCount: {{ .Values.replicas.openxchangeNextcloudIntegrationUI }}
   resources:
     {{ .Values.resources.openxchangeNextcloudIntegrationUI | toYaml | nindent 4 }}
@@ -62,7 +67,8 @@ public-sector-ui:
   {{- end }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   replicaCount: {{ .Values.replicas.openxchangePublicSectorUI }}
-  podAnnotations: {}
+  podAnnotations:
+    {{ .Values.annotations.openxchangePublicSectorUi.pod | toYaml | nindent 4 }}
   resources:
     {{ .Values.resources.openxchangePublicSectorUI | toYaml | nindent 4 }}
   securityContext:
@@ -91,6 +97,8 @@ appsuite:
   istio:
     enabled: false
   ingress:
+    annotations:
+      {{ .Values.annotations.openxchangeAppsuiteIngress.ingress | toYaml | nindent 6 }}
     enabled: {{ .Values.ingress.enabled }}
     ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
     tls:
@@ -103,11 +111,101 @@ appsuite:
       hosts:
         - "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
     routes:
+      appsuite-base:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.appsuitebase | toYaml | nindent 10 }}
+      rootredirect:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.rootredirect | toYaml | nindent 10 }}
+      trailslash:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.trailslash | toYaml | nindent 10 }}
+      rest-routes-admin:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.restRoutesAdmin | toYaml | nindent 10 }}
+      rest-routes-advertisement:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.restRoutesAdvertisement | toYaml | nindent 10 }}
+      rest-routes-chronos:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.restRoutesChronos | toYaml | nindent 10 }}
+      rest-routes-preliminary:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.restRoutesPreliminary | toYaml | nindent 10 }}
+      rest-routes-userfeedback:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.restRoutesUserfeedback | toYaml | nindent 10 }}
+      static-routes-servlet:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.staticRoutesServlet | toYaml | nindent 10 }}
+      static-routes-realtime:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.staticRoutesRealtime | toYaml | nindent 10 }}
+      static-routes-infostore:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.staticRoutesInfostore | toYaml | nindent 10 }}
+      static-routes-webservices:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.staticRoutesWebservices | toYaml | nindent 10 }}
+      drive-client-windows-ox-route:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.driveClientWindowsOxRoute | toYaml | nindent 10 }}
+      guard-api-route:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.guardApiRoute | toYaml | nindent 10 }}
+      guard-support-api-route:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.guardSupportApiRoute | toYaml | nindent 10 }}
+      guard-pgp-route:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.guardPgpRoute | toYaml | nindent 10 }}
+      http-api-routes-api:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.httpApiRoutesApi | toYaml | nindent 10 }}
+      http-api-routes-ajax:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.httpApiRoutesAjax | toYaml | nindent 10 }}
       http-api-routes-appsuite-api:
         annotations:
           nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.oxAppSuite }}"
           nginx.ingress.kubernetes.io/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.oxAppSuite }}"
           nginx.ingress.kubernetes.io/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.oxAppSuite }}"
+          {{- with .Values.annotations.openxchangeAppsuiteIngress.httpApiRoutesAppsuiteApi }}
+          {{ . | toYaml | nindent 10 }}
+          {{- end }}
+      http-api-routes-app-root-api:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.httpApiRoutesAppRootApi | toYaml | nindent 10 }}
+      rt2-route:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.rt2Route | toYaml | nindent 10 }}
+      documents-help-route:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.documentsHelpRoute | toYaml | nindent 10 }}
+      drive-help-route:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.driveHelpRoute | toYaml | nindent 10 }}
+      core-help-route:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.coreHelpRoute | toYaml | nindent 10 }}
+      office-web-route:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.officeWebRoute | toYaml | nindent 10 }}
+      caldav-well-known-redirect:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.caldavWellKnownRedirect | toYaml | nindent 10 }}
+      carddav-well-known-redirect:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.carddavWellKnownRedirect | toYaml | nindent 10 }}
+      dav-infostore-route:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.davInfostoreRoute | toYaml | nindent 10 }}
+      dav-root-route:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.davRootRoute | toYaml | nindent 10 }}
+      wopi-server-route:
+        annotations:
+          {{ .Values.annotations.openxchangeAppsuiteIngress.wopiServerRoute | toYaml | nindent 10 }}
       trailslash:
         enabled: false
   core-mw:
@@ -115,7 +213,7 @@ appsuite:
     asConfig:
       default:
         host: "all"
-        pageHeaderPrefix: "as8.souvap App Suite"
+        productName: {{ .Values.theme.texts.productName | quote }}
         oidcLogin: true
         oidcPath: "/oidc"
     masterAdmin: "admin"
@@ -127,8 +225,11 @@ appsuite:
     jolokiaLogin: "jolokia"
     jolokiaPassword: {{ .Values.secrets.oxAppSuite.jolokiaPassword | quote }}
     hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
-    podAnnotations: {}
+    podAnnotations:
+      {{ .Values.annotations.openxchangeAppsuiteCoreMw.pod | toYaml | nindent 6 }}
     serviceAccount:
+      annotations:
+        {{ .Values.annotations.openxchangeAppsuiteCoreMw.serviceAccount | toYaml | nindent 8 }}
       create: true
     features:
       status:
@@ -147,7 +248,8 @@ appsuite:
         tag: {{ .Values.images.openxchangeGotenberg.tag | quote }}
         pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
       replicaCount: {{ .Values.replicas.openxchangeGotenberg }}
-      podAnnotations: {}
+      podAnnotations:
+        {{ .Values.annotations.openxchangeAppsuiteCoreMw.gotenbergPod | toYaml | nindent 8 }}
       resources:
         {{ .Values.resources.openxchangeGotenberg | toYaml | nindent 8 }}
       securityContext:
@@ -175,14 +277,16 @@ appsuite:
     packages:
       status:
         {{- if .Values.functional.migration.oxAppSuite.enabled }}
-        open-xchange-authentication-masterpassword: "enabled"
-        open-xchange-authentication-ldap: "disabled"
-        open-xchange-authentication-oauth: "disabled"
         open-xchange-oidc: "disabled"
+        open-xchange-authentication-oauth: "disabled"
+        open-xchange-authentication-masterpassword: "enabled"
+        open-xchange-authentication-database: "disabled"
+        open-xchange-authentication-ldap: "disabled"
         {{- else }}
         open-xchange-oidc: "enabled"
-        open-xchange-authentication-database: "disabled"
         open-xchange-authentication-oauth: "enabled"
+        open-xchange-authentication-masterpassword: "disabled"
+        open-xchange-authentication-database: "disabled"
         open-xchange-authentication-ldap: "disabled"
         {{- end }}
         # OX Documents (office-web) is not used in openDesk
@@ -237,7 +341,7 @@ appsuite:
       com.openexchange.mail.mailServer: "dovecot"
       com.openexchange.mail.mailServerSource: "global"
       com.openexchange.mail.transport.authType: "xoauth2"
-      com.openexchange.mail.transportServer: "postfix"
+      com.openexchange.mail.transportServer: "postfix-ox"
       com.openexchange.mail.transportServerSource: "global"
       # Requirements for OX-Connector
       com.openexchange.user.enforceUniqueDisplayName: "false"
@@ -276,14 +380,19 @@ appsuite:
       com.openexchange.conference.element.enabled: "true"
       com.openexchange.conference.element.meetingHostUrl: http://matrix-neodatefix-bot
       com.openexchange.conference.element.matrixLoginUrl: http://opendesk-synapse-web:8008/_matrix/client/v3/login
-      com.openexchange.conference.element.matrixUuidClaimName: opendesk_useruuid
+      com.openexchange.conference.element.matrixUuidClaimName: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"opendesk_useruuid"{{ else }}"opendesk_username"{{ end }}
       # GDPR
       com.openexchange.gdpr.dataexport.enabled: "false"
       com.openexchange.gdpr.dataexport.active: "false"
       # Guard
       com.openexchange.guard.storage.file.fileStorageType: "file"
       com.openexchange.guard.storage.file.uploadDirectory: "/opt/open-xchange/guard-files/"
+      com.openexchange.guard.guestSMTPMailFrom: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
+      com.openexchange.guard.guestSMTPPassword: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+      com.openexchange.guard.guestSMTPPort: "25"
       com.openexchange.guard.guestSMTPServer: "postfix"
+      com.openexchange.guard.guestSMTPUsername: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
+      com.openexchange.guard.useStartTLS: "false"
       # S/MIME
       # Usage (in browser console after login):
       # http = (await import('./io.ox/core/http.js')).default
@@ -321,8 +430,10 @@ appsuite:
       com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppSuite.shareCryptKey | quote }}
       com.openexchange.conference.element.authToken: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
     propertiesFiles:
+      {{- if .Values.functional.migration.oxAppSuite.enabled }}
       /opt/open-xchange/etc/masterpassword-authentication.properties:
         com.openexchange.authentication.masterpassword.password: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
+      {{- end }}
       /opt/open-xchange/etc/AdminDaemon.properties:
         MASTER_ACCOUNT_OVERRIDE: "true"
       /opt/open-xchange/etc/AdminUser.properties:
@@ -330,8 +441,8 @@ appsuite:
       /opt/open-xchange/etc/system.properties:
         SERVER_NAME: "oxserver"
       /opt/open-xchange/etc/ldapauth.properties:
-        java.naming.provider.url: "ldap://{{ .Values.ldap.host }}:389/dc=swp-ldap,dc=internal"
-        bindDN: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
+        java.naming.provider.url: "ldap://{{ .Values.ldap.host }}:389/{{ .Values.ldap.baseDn }}"
+        bindDN: "uid=ldapsearch_ox,cn=users,{{ .Values.ldap.baseDn }}"
         bindDNPassword: {{ .Values.secrets.nubus.ldapSearch.ox | quote }}
         bindOnly: "false"
       /opt/open-xchange/etc/antivirus.properties:
@@ -340,9 +451,9 @@ appsuite:
         com.openexchange.antivirus.server: {{ .Values.antivirus.icap.host | quote }}
         com.openexchange.antivirus.port: {{ .Values.antivirus.icap.port | quote }}
         {{- else }}
-        {{- if .Values.clamavDistributed.enabled }}
+        {{- if .Values.apps.clamavDistributed.enabled }}
         com.openexchange.antivirus.server: "clamav-icap"
-        {{- else if .Values.clamavSimple.enabled }}
+        {{- else if .Values.apps.clamavSimple.enabled }}
         com.openexchange.antivirus.server: "clamav-simple"
         {{- end }}
         com.openexchange.antivirus.port: "1344"
@@ -412,6 +523,8 @@ appsuite:
     # podSecurityContext: {}
     # securityContext: {}
     update:
+      podAnnotations:
+        {{ .Values.annotations.openxchangeAppsuiteCoreMw.updatePod | toYaml | nindent 8 }}
       image:
         repository: {{ .Values.images.openxchangeCoreMW.repository | quote }}
         tag: {{ .Values.images.openxchangeCoreMW.tag | quote }}
@@ -438,7 +551,8 @@ appsuite:
       tag: {{ .Values.images.openxchangeCoreUI.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     replicaCount: {{ .Values.replicas.openxchangeCoreUI }}
-    podAnnotations: {}
+    podAnnotations:
+      {{ .Values.annotations.openxchangeAppsuiteCoreUi.pod | toYaml | nindent 6 }}
     resources:
       {{ .Values.resources.openxchangeCoreUI | toYaml | nindent 6 }}
     securityContext:
@@ -474,7 +588,8 @@ appsuite:
       tag: {{ .Values.images.openxchangeCoreUIMiddleware.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     overrides: {}
-    podAnnotations: {}
+    podAnnotations:
+      {{ .Values.annotations.openxchangeAppsuiteCoreUiMiddleware.pod | toYaml | nindent 6 }}
     redis: *redisConfiguration
     replicaCount: {{ .Values.replicas.openxchangeCoreUIMiddleware }}
     resources:
@@ -517,7 +632,10 @@ appsuite:
       repository: {{ .Values.images.openxchangeDocumentConverter.repository | quote }}
       tag: {{ .Values.images.openxchangeDocumentConverter.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    podAnnotations: {}
+    {{- if .Values.annotations.openxchangeAppsuiteCoreDocumentconverter.pod }}
+    podAnnotations:
+      {{ .Values.annotations.openxchangeAppsuiteCoreDocumentconverter.pod | toYaml | nindent 6 }}
+    {{- end }}
     redis: *redisConfiguration
     replicaCount: {{ .Values.replicas.openxchangeCoreDocumentConverter }}
     resources:
@@ -567,7 +685,8 @@ appsuite:
       repository: {{ .Values.images.openxchangeCoreGuidedtours.repository | quote }}
       tag: {{ .Values.images.openxchangeCoreGuidedtours.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    podAnnotations: {}
+    podAnnotations:
+      {{ .Values.annotations.openxchangeAppsuiteCoreGuidedtours.pod | toYaml | nindent 6 }}
     replicaCount: {{ .Values.replicas.openxchangeCoreGuidedtours }}
     resources:
       {{- .Values.resources.openxchangeCoreGuidedtours | toYaml | nindent 6 }}
@@ -605,7 +724,10 @@ appsuite:
           endpoint: "."
           accessKey: "."
           secretKey: "."
-    podAnnotations: {}
+    {{- if .Values.annotations.openxchangeAppsuiteCoreImageconverter.pod }}
+    podAnnotations:
+      {{ .Values.annotations.openxchangeAppsuiteCoreImageconverter.pod | toYaml | nindent 6 }}
+    {{- end }}
     redis: *redisConfiguration
     replicaCount: {{ .Values.replicas.openxchangeCoreImageConverter }}
     resources:
@@ -674,7 +796,8 @@ appsuite:
     {{- range .Values.global.imagePullSecrets }}
       - name: {{ . | quote }}
     {{- end }}
-    podAnnotations: {}
+    podAnnotations:
+      {{ .Values.annotations.openxchangeAppsuiteCoreUserGuide.pod | toYaml | nindent 6 }}
     replicaCount: {{ .Values.replicas.openxchangeCoreUserGuide }}
     resources:
       {{- .Values.resources.openxchangeCoreUserGuide | toYaml | nindent 6 }}

helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl

@@ -69,37 +69,32 @@ persistence:
   size: {{ .Values.persistence.storages.oxConnector.size | quote }}
   storageClass: {{ coalesce .Values.persistence.storages.oxConnector.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
 
-podAnnotations: {}
+podAnnotations:
+  {{ .Values.annotations.nubusOxConnector.pod | toYaml | nindent 2 }}
 
 replicaCount: {{ .Values.replicas.oxConnector }}
 
+podSecurityContext:
+  fsGroup: 1000
+
 securityContext:
+  privileged: false
   allowPrivilegeEscalation: false
   capabilities:
     drop:
       - "ALL"
-    add:
-      - "CHOWN"
-      - "DAC_OVERRIDE"
-      - "FOWNER"
-      - "FSETID"
-      - "KILL"
-      - "SETGID"
-      - "SETUID"
-      - "SETPCAP"
-      - "NET_BIND_SERVICE"
-      - "SYS_CHROOT"
-  privileged: false
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 1000
   seccompProfile:
     type: "RuntimeDefault"
-  runAsUser: 0
-  runAsGroup: 0
-  runAsNonRoot: false
-  readOnlyRootFilesystem: false
   seLinuxOptions:
     {{ .Values.seLinuxOptions.oxConnector | toYaml | nindent 4 }}
 
 serviceAccount:
+  annotations:
+    {{ .Values.annotations.nubusOxConnector.serviceAccount | toYaml | nindent 4 }}
   create: true
 
 ...

helmfile/apps/open-xchange/values-postfix.yaml.gotmpl

@@ -0,0 +1,103 @@
+{{/*
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+certificate:
+  secretName: {{ .Values.ingress.tls.secretName | quote }}
+  request:
+    enabled: false
+
+containerSecurityContext:
+  allowPrivilegeEscalation: true
+  capabilities: {}
+  enabled: true
+  seccompProfile:
+    type: "RuntimeDefault"
+  readOnlyRootFilesystem: true
+  runAsNonRoot: false
+  runAsUser: 0
+  runAsGroup: 0
+  privileged: true
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.postfix | toYaml | nindent 4 }}
+
+global:
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.postfix.registry | quote }}
+  repository: {{ .Values.images.postfix.repository | quote }}
+  tag: {{ .Values.images.postfix.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+persistence:
+  size: {{ .Values.persistence.storages.postfix.size | quote }}
+  storageClass: {{ coalesce .Values.persistence.storages.postfix.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+
+podSecurityContext:
+  enabled: true
+  fsGroup: 101
+
+postfix:
+  amavisHost: ""
+  amavisPortIn: ""
+  domain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
+  hostname: "postfix"
+  inetProtocols: "ipv4"
+  milterDefaultAction: "tempfail"
+  overrides:
+    - fileName: "sasl_passwd.map"
+      content:
+        - {{ printf "%s %s:%s" .Values.smtp.host .Values.smtp.username .Values.smtp.password | quote }}
+  {{- if .Values.apps.dkimpy.enabled }}
+  dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
+  {{- end }}
+  rspamdHost: ""
+  relayHost: {{ if .Values.smtp.host }}{{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}{{ else }}""{{ end }}
+  allowRelayNets: false
+  smtpSASLAuthEnable: "yes"
+  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
+  smtpTLSSecurityLevel: "encrypt"
+  smtpdSASLAuthEnable: "yes"
+  smtpdSASLSecurityOptions: "noanonymous"
+  smtpdSASLType: "dovecot"
+  smtpdTLSSecurityLevel: "encrypt"
+  smtpdTLSCertFile: "/etc/tls/tls.crt"
+  smtpdKeyFile: "/etc/tls/tls.key"
+  smtpdSASLPath: "inet:dovecot:3659"
+
+  staticAuthDB:
+    enabled: false
+
+  {{- if .Values.antivirus.milter.host }}
+  smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
+  {{- else }}
+  {{- if .Values.apps.clamavDistributed.enabled }}
+  smtpdMilters: "inet:clamav-milter:7357"
+  {{- else if .Values.apps.clamavSimple.enabled }}
+  smtpdMilters: "inet:clamav-simple:7357"
+  {{- end }}
+  {{- end }}
+  virtualMailboxDomains: {{ toYaml (prepend .Values.global.additionalMailDomains (.Values.global.mailDomain | default .Values.global.domain) | uniq) | nindent 4 }}
+  virtualTransport: "lmtps:dovecot:24"
+
+podAnnotations:
+  {{ .Values.annotations.openxchangePostfix.pod | toYaml | nindent 2 }}
+
+replicaCount: {{ .Values.replicas.postfix }}
+
+resources:
+  {{ .Values.resources.postfix | toYaml | nindent 2 }}
+
+{{- if or (eq (coalesce .Values.service.type.postfix .Values.cluster.service.type) "NodePort") (eq (coalesce .Values.service.type.postfix .Values.cluster.service.type) "LoadBalancer") }}
+service:
+  annotations:
+    {{ .Values.annotations.openxchangePostfix.service | toYaml | nindent 4 }}
+  external:
+    enabled: true
+    type: {{ coalesce .Values.service.type.postfix .Values.cluster.service.type | quote }}
+{{- end }}
+...

helmfile/apps/opendesk-migrations-post/helmfile-child.yaml.gotmpl

@@ -4,17 +4,17 @@
 repositories:
   # openDesk Migrations
   # Source:
-  - name: "openproject-migrations-repo"
+  - name: "opendesk-migrations-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.migrations.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
 
 releases:
   - name: "opendesk-migrations-post"
-    chart: "openproject-migrations-repo/{{ .Values.charts.migrations.name }}"
+    chart: "opendesk-migrations-repo/{{ .Values.charts.migrations.name }}"
     version: "{{ .Values.charts.migrations.version }}"
     wait: true
     waitForJobs: true
@@ -24,7 +24,7 @@ releases:
       {{- range .Values.customization.release.migrationsPost }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.migrations.enabled }}
+    installed: {{ .Values.apps.migrations.enabled }}
     timeout: 900
 
 commonLabels:

helmfile/apps/opendesk-migrations-post/values.yaml.gotmpl

@@ -3,7 +3,15 @@
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
-podAnnotations: {}
+additionalAnnotations:
+  {{ .Values.annotations.opendeskMigrationsPost.additional | toYaml | nindent 2 }}
+
+podAnnotations:
+  {{ .Values.annotations.opendeskMigrationsPost.pod | toYaml | nindent 2 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.opendeskMigrationsPost.serviceAccount | toYaml | nindent 4 }}
 
 migrations:
   stage: "POST"

helmfile/apps/opendesk-migrations-pre/helmfile-child.yaml.gotmpl

@@ -10,7 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
 
 releases:
   - name: "opendesk-migrations-pre"
@@ -24,7 +24,7 @@ releases:
       {{- range .Values.customization.release.migrationsPre }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.migrations.enabled }}
+    installed: {{ .Values.apps.migrations.enabled }}
     timeout: 900
 
 commonLabels:

helmfile/apps/opendesk-migrations-pre/values.yaml.gotmpl

@@ -3,7 +3,15 @@
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
-podAnnotations: {}
+additionalAnnotations:
+  {{ .Values.annotations.opendeskMigrationsPre.additional | toYaml | nindent 2 }}
+
+podAnnotations:
+  {{ .Values.annotations.opendeskMigrationsPre.pod | toYaml | nindent 2 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.opendeskMigrationsPre.serviceAccount | toYaml | nindent 4 }}
 
 migrations:
   stage: "PRE"

helmfile/apps/opendesk-openproject-bootstrap/helmfile-child.yaml.gotmpl

@@ -3,14 +3,14 @@
 ---
 repositories:
   # openDesk OpenProject Bootstrap
-  # Source: Set when repo is managed on Open CoDE
+  # Source: Set when repo is managed on openCode
   - name: "openproject-bootstrap-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.openprojectBootstrap.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
 
 releases:
   - name: "opendesk-openproject-bootstrap"
@@ -23,7 +23,7 @@ releases:
       {{- range .Values.customization.release.opendeskOpenprojectBootstrap }}
       - {{ . }}
       {{- end }}
-    installed: {{ .Values.openproject.enabled }}
+    installed: {{ .Values.apps.openproject.enabled }}
     timeout: 900
 
 commonLabels:

helmfile/apps/opendesk-openproject-bootstrap/values.yaml.gotmpl

@@ -11,8 +11,12 @@ global:
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
+additionalAnnotations:
+  {{ .Values.annotations.openprojectBootstrap.additional | toYaml | nindent 2 }}
+
 cleanup:
   deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
   keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
 
 config:
@@ -21,12 +25,16 @@ config:
   openproject:
     fileshareName: "Nextcloud at {{ .Values.global.domain }}"
     admin:
-      username: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
-      password: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
+      username: 
+        value: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
+      password:
+        value: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
   nextcloud:
     admin:
-      username: "nextcloud"
-      password: {{ .Values.secrets.nextcloud.adminPassword | quote }}
+      username:
+        value: "nextcloud"
+      password:
+        value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -67,6 +75,9 @@ image:
 job:
   enabled: true
 
+podAnnotations:
+  {{ .Values.annotations.openprojectBootstrap.pod | toYaml | nindent 2 }}
+
 podSecurityContext:
   enabled: true
   fsGroup: 1000